skysight-inc/HackerNews huggingface dataset:
In practice, in many cases, bug bounties are de facto a bid in an auction against organized crime. It doesn't need to be 1-to-1 equivalent bid, and it's not for all sources of found bugs, but the intent and the effect is definitely there.
Very cool. Salaries seem on the low-end of the industry standards from what I've seen. $120k for 5 years of experience in the Bay-Area is pretty insulting.
I rarely hear complaints about the closed-platform monopolies enjoyed by the App Store and Google Play, on their respective iOS/Android platforms. Can someone make a case for why a similar app-store monopoly on Windows is any worse?
Seems clickbait to me! Most of the pictures are _outside_ the gigafactory.
Apparently Microsoft isn't allowed to evolve Windows with objectively better API's.

Have fun with your GetLastError, fifteen parameter functions, and poorly documented flags. But hey, at least it doesn't have much security, so I can download game mods from some unknown source that have full access to everything on my PC.
Hike dem goalposts!
14 consecutive, global hottest months ever (1)

So june last year, which was as much summer as this one was, was hotter than all previous junes, all of which were in summer. And this june was hotter.

1: in modern times, I assume
Not to mention supporting linux more aggressively.
I don't think religion had anything to do with that decision.
Can't stress this enough. Find one. Stat.
Deploy your app from Slack
For bucklescript, the performance is excellent, better than handwritten JS: https://github.com/bloomberg/bucklescript#more-examples-1
flat blocking of nuclear is unreasonable. But in my opinion disagreement on the issue is a relatively marginal issue in the general sweep of tackling climate change.

The new DNC platform coming out of the convention this week doesn't seem to agree with you. It focuses solely on renewable sources, sweeping nuclear under the carpet.

70-80% of people agree that anthropogenic climate change is happening

I don't understand why those concerned about climate change continue to insist on putting the word "anthropogenic" in there. It's mostly irrelevant to the conversation, and comes off as little more than finger-pointing. If there's a problem that needs to be addressed, whether it's caused by humans or not isn't really the issue. If there were an asteroid heading toward the earth, we wouldn't say "we didn't throw that rock at ourselves, so we'll ignore it". Likewise, the discussion over climate change should be on the climate change; trying to make the cause of the problem part of its name just creates additional contention.
It's not ad hominem, he talks specifically about the article, not the person.

>>> His work goes after the hot topics and either states the obvious or makes several low information content, i.e., not disapprovable points
A Market for Lemons: The New Software Crisis
Do you have a way to reply to the person? I don't see any harm in thanking them and asking for more details.

But in the meantime I'd have to assume everything is compromised: save a copy or an image of the server for analysis, but take it offline and build a new one. Rotate all passwords and credentials. Assuming you're not doing something strange with SSH, they probably got legitimate credentials from a compromise somewhere else or password reuse or a compromised development machine, etc. There are guides online for doing this: https://support.rackspace.com/how-to/recovering-from-and-dea...

It sucks. Sorry.
A substantial chunk of ESA's budget comes through EU. So the cost of UK's membership in ESA might increase, as they won't be participating through EU anymore.

That's the kind of thing that is hard to justify to Brexiteer voters though... "Now that we're rid of the EU, we have a unique opportunity to pay more tax money to other intergovernmental organisations!"
Re-read the manifesto. You'll notice that its theme is not about a person's natural abilities or smarts, but self awareness. The manifesto can basically be boiled down to "show humility in your own code". Always assume that there is potential for improvement, and be ready for when that potential becomes a need.

It's about mindfulness towards our own product. "Mediocrity", in this case, is turning a blind eye towards our own limits. All people have the ability to overcome this form of mediocrity.
If this was a thread about a Facebook vulnerability, the exact same things would be said about Facebook. To verify for yourself, use the search box at the bottom of the page to find a thread about a Facebook bounty.
If you and the people who work there don't know what to do, you most likely won't solve your problem by asking this generic question here or elsewhere. I'd suggest making an honest assessment of the value of your business and information, and depending on the numbers, considering the possibility of hiring a professional who can help you secure your systems.
https://m.reddit.com/r/programming/comments/4um9uh/issue_tra...
I never fully trusted any centralized password managers. Since I'm a paranoid goober, I've ended up dumping LastPass and using the Unix "pass" tool.

Anyway, I'm glad that LastPass has resolved this; last thing I want in the news is another big password breach.
New free VPN, 4096bits, No-Logs and open-source
I'm sure they will continue, but as an EU member state working in the EU is much easier. Perhaps the skill levels will overcome any friction from visas and bureaucracy.
If I try to max out everything (engineering manager, 25 years of experience, max expertise), I still only end up with $210k. Are there stock options on top of the salary to provide a larger upside?

That being said, thanks for the transparency. It helps all of us.
I'm not assuming anything, I'm saying it's a possibility. The Russian hacker story just seems bizarre and made up, just like the Sony North Korea story.

Here's an interview with Julian Assange when asked about the source of the leaks, with direct quotes from Clinton's campaign manager, quoting unnamed experts: https://youtu.be/axuJfX3cO9Q?t=12m50s

"On Sunday morning, the issue erupted, as Mrs. Clinton’s campaign manager, Robby Mook, argued on ABC’s “This Week” that the emails were leaked “by the Russians for the purpose of helping Donald Trump” citing “experts” but offering no other evidence."

http://www.nytimes.com/2016/07/25/us/politics/donald-trump-r...

I mean anyone can quote anonymous "experts" to craft a narrative. Doesn't make it true.
i work at a hedge fund where people are nice, there are yoga break-out spaces (literally), and the prevalent culture is laid-back, like a typical west-coast tech company, or academia.
Your answer is based on the assumption that numbers (of people) matter. However, it is the decisions of some very few people (compared to the overall population) that has orders of magnitude higher influence compared to the decisions of everybody else, so making the rest "aware" of whatever issue has next to zero influence.

That is simply the outcome of human society's organization for scalability and nothing nefarious.

An equivalent in the brain is that even thousands of synaptic connections to a neuron a few matter orders of magnitude more than all others, a handful of those can together trigger an action potential but if they don't contribute a graded potential it takes hundreds or even thousands of the others. In addition, the (much less numerous) inhibitory neurons have far greater weight than the excitatory ones, similarly in a human network key players have a much easier time blocking something than getting something to be done. In a network some nodes matter much more than others. You are better off identifying who actually matters instead of yelling into the forest. That approach also has the disadvantage of leading to disillusionment and in the end disengagement of those trying it because the results are meager.
There's no venting or contours, and just two materials: meta and carbon fibre. Personally, I find the carbon fibre much more pleasant to rest my wrists on than metal and it looks quite nice in person. The thing that looks like venting on the left edge is actually a battery indicator. I'd get rid of it, personally, but that's my only real complaint about its looks.
How the PDP-11 worked actually.
It’s the data, stupid: Why database admins are more important than ever
What would be a more competitive number in the bay area for 5 years of experience?
I meant the Model 3. Theoretically it will be $35k for a base model with 200 mile range, and the Bolt is also not much less theoretical than the Model 3 at this point. There are lots of reasons to be skeptical about the time frame of availability and hitting production numbers of the Model 3, but Tesla has been pretty good about hitting the raw performance and price numbers they announce.
He's not really arguing anything. He was explaining why F2 was picked as the key for renaming; all the F keys were random and arbitrary. He never said whether thats the best way or the only way; he's not advocating it. Merely stating that the F keys were intended for arbitrary functions.
Here you have ESA funding by source:
http://www.esa.int/spaceinimages/Images/2016/01/ESA_budget_2...

EU funding doesn't go to the main funding budget of ESA but to other activities like the Galileo satellite system.
This is nonsense on stilts. There aren't UWP versions of half of Office, and the ones with UWP versions aren't as full-featured as the Win32 versions. There's no UWP version of Visual Studio. Look at the revenue from those two things, look at Microsoft's gaming revenue, look at Valve's revenue... what is the evidence that Microsoft is willing to sabotage their Windows, Office and Visual Studio product lines all to get a rounding error's worth of additional profit?
No, they are virtually never a bid against organized crime.

There are two kinds of vulnerabilities in the world:

The kind organized criminals will pay tens of thousands of dollars for, and the kind they, like any Internet rando, will pay $50 for lulz.

If you think this dumb regex bug is worth the same to organized criminals as a Chrome sandbox escape or drive-by reliable Flash RCE... well, people think that about a lot of bugs, I guess.

This LastPass bug is terrible. I was already inclined to warn friends against using it (but my other friends have beat me to that punch many times before). The bug looks terrible for LastPass and its mere existence is damaging to that project.

But that doesn't mean the bug has significant monetary value. As someone else here cleverly put it on the last dumb bug bounty thread: you can smash a car with a sledgehammer, but that doesn't make the sledgehammer worth the value of the car.
[Edit: not-OP]

As the 2 comments so-far have suggested getting security experts, where would be a good place to source security experts? I'm envisioning 2 kinds:

* Consultant, working for a fee (with retainer?);

* Independent, may be consultant, but could also be someone currently looking for a new permanent role and would bring welcome diversity/expertise to a small team - potentially illiquid / poorly matched hiring market that could be nice for many smaller companies to tap? Working remotely could work too - no borders/boundaries.
I had something similar thing happen several years ago when I was a grad student. Me and a couple friends were putting together some Facebook apps (when they were a new thing), and one guy didn't escape user input correctly. Some teenager from an Eastern European country (I can't remember which anymore) ran a script to figure out that we were vulnerable to SQL injections. He was a nice enough guy and didn't want anything besides some experience "hacking". We patched up the code and told him thank you.

I understand you're running a business which makes it that much more scary. If he's not asking for ransom, you might ask him how he'd fix it. I know it might seem like blackmail, but you might even offer him a "consulting fee". He's probably just someone looking to try new things out and not malevolent.
Tesla is dialed into how modern media works. Every press release makes it to HN and other tech sites, who proudly proclaim "No marketing budget!"

It's genius.
If transhumans are easily identifiable, then I agree. But imagine a GATTACA-like future, where genetically-enhanced humans look just like regular humans - they just happen to be at the 90th percentile in intelligence/fitness. There is very little that people can do in such a scenario.
The Hazards of Ankle Sprains
also remember to do the same on every server that could be reached by sharing the same credentials or having the same vulnerability once discovered, and at the end of the process trigger password change for every user if applicable
Drift simulation of MH370 debris using superensemble techniques
Here's a source specifically for the EU portion of the ESA budget:

http://www.esa.int/About_Us/Welcome_to_ESA/ESA_and_the_EU

"Some 20 per cent of the funds managed by ESA now originate from the EU budget."

I'm not disagreeing with you, but it seems unlikely that UK just won't participate in that 20% of ESA activities anymore. So they'll have to renegotiate the membership fee to account for that.
If Microsoft ever deprecates Win32, they won't sneak it overnight. Anyone can integrate UWP into their store today if they want, and they would have plenty of time to do it. This is a company that still supports Windows XP from 2001 with special contracts. It seems strange to compare this theoretical point in the future where Win32 is deprecated with who supports it right now. It's a good point that it's important to have platforms that no one company controls, but this fear of UWP seems unjustified when it's open to anyone.
No matter what it is, you don't just give someone something they didn't ask for, and then expect money in return.

It would be like someone walking up to you on the street, handing you something they think is valuable, and then hoping that you'll want it and pay them for it.

The first thing you should do is check and see if they have an official bug bounty, if they don't then contact them and ask them if they had one.. say something like "because you saw some things on their site that concerned you, but wanted to know if it was worth the time exploring further" .. this is assuming you already found something. The goal of this is to get them to try and offer a bounty.

If they don't offer a bounty, then if you want to be responsible, you can just disclose their vulnerabilities to them, and accept whatever thanks you get.

If you're explicitly doing what you're doing to try and get some money out of it, then your time would be better spent focusing on companies that have well published bug bounties.
How do various formats (PNG,GIF,JPEG,) compress a blank image?
Given that no threat or demand was made, this sounds like they were just notifying you of a vulnerability.

Does your company / product have an official responsible disclosure policy?
Because apparently having an “abandoned or vacant building open to the public” is illegal. You also need to have the correct permits.

Even for things on your own land.

As to the color, no, it won't make a difference. It's only one of many complaint or problems given.
There's footage in the video but they seem to be trying to keep most of their production processes secret.
Don't miss the Windows 10 free upgrade deadline this week
Or contact the person if you can and ask them how they got in maybe even offer him a financial reward.

Since he contact you Anonymously and is not trying to extort you he's just trying to point the issue out so there's no point in over reacting.
Well, science also gave us Josef Mengele. He was done with puny religious and moral concerns too.
The salaries generated by the calculator while transparent are not validated by the market and are laughably low.

Given the elasticity of supply and demand the salary mush be constantly evaluated against the market. This seems like just another trick to suppress wages for a qualified engineer.

In today's market, a person with multiple offers would command at least twice the listed compensation at any of the software majors.
That still qualifies as a hit against the statement "Xiaomi means quality." Brand protection is hard, but also really important. It'll probably become more evident over the next few years why Apple has always been so vicious about it.
LastPass user here, thanks for getting this fixed. For any other bug/attack like this in future, I suggest we uncheck this option: "Automatically Fill Login Information" in preferences tab. Will this would have helped in case of this attack? Or information still would have been leaked?
Something to consider is a mis-alignment of incentives.

When LastPass gets breached, they're not directly responsible for what an attacker does with the passwords.

When another site/service gets breached, they have to spend a lot of time making it right to the customer again (e.g. rolling back transactions, compensating for lost or stolen funds, etc.)
It looks to me that it incentivizes working outside of SF, or NY. $110k for a developer with 5 years experience in Cleveland is just about right, if not on the higher end.
An easily understandable report of the same research:

MH370: Missing jet 'could be further north' - http://www.bbc.co.uk/news/science-environment-36904981
Well, you are looking in the wrong places then, there's plenty of complaints about apple/google walled gardens and people don't want windows to be the next one.
The issue is less with anti-science sediment, and more with international treaties against such things.
Doesn't matter. Even a log-structured fs, when told to write 4 bytes of new data to disk will have to write those 4 bytes immediately and return. If an application asks the OS (via fsync), and the OS asks the fs and the fs doesn't write to disk but tells the OS it did, then the fs just lied and risked data loss.

If power is lost between the fs lying to the OS and its subsequently actually writing to disk, the data that the fs lied about is lost.

You don't want that with a DB on top of it.
Summary: Ankle sprains happen frequently yet are not always properly rehabilitated which can lead to repetitive injury and long term negative health effects like "poor balance, a distorted gait, difficulty exercising, weight gain, diminished quality of life and early arthritis. Not to mention the expense of dealing with health problems that can result from being overweight and sedentary living." So, strengthen your ankles and be wise about opportunities for over-exertion.
This is fantastic; the perfect example of tilting at windmills. So, I'll take up the role of Sancho.

Using tools to craft a work of art? I'm sure some projects deserve our collective accolades, but no one should consider them art. The only projects that should end up in a museum are those that are no longer in use.

Risk of bugs increases with each piece of code? I'm sure this is impossible. The risk is already 100%: there will be bugs. They only increase in volume.

Always be wary of fancy websites? I'm sure the rant preceding this nugget has a point (e.g. maybe "never compromise on code quality), but let's be honest: a fancy website is a work of art, See #1.

Withstood the tooth of time? I'm sure these mixed metaphors are meant to be poetic, but when you lead with a statement followed by an exception, then your whiskey spigot can engender an acreage of Hidalgo.
Verizon currently makes a profit, Tesla doesn't[1].

1. They might be able to run a profit without R&D expenses, but that wouldn't make any sense at this point, so they are bleeding money and need to raise capital constantly.
How brands can build trust through Content Marketing
> religious anti-science sediment

I'm assuming a typo, but this made me chuckle anyway; sediment is an inventive insult.
No problem on Windows thanks to .NET and COM.

C++ provides better tools to write safer code than C ever will.

I would rather be using Ada, Rust, System C#, D, <whatever safe systems programming language>, but until OS vendors start providing something else, C++17 will have to do.

Since 1994 I only write C code when forced to do so.
>Wake me up when Visual Studio or SQL Management Studio is rewritten as a UWP app.

Given that they already ported an entire browser to UWP (Edge), that may happen sooner than you think. I wouldn't consider a browser a "toy".
iPhone users are very happy.
I don't really know, but could it be that you can buy a company with mainly stock yet building things requires cash?

Panasonic has invested just under $2bn in the plant. I assume that's in cash.
If I understood correctly, the decision not to use an RTG was also due to its weight.

That said, it seems there is not much know-how about RTGs at ESA, which is most likely also influenced by political reasons.
Yoga!!! Don't knock it till you've tried it.
Highly doubt that. They are losing to Huawei and Oppo in smartphone sales in China.
I guess the point people (including me) are making is that it should pay off to do the right thing and report a bug that is capable of killing your (core) business. While OP obviously is a honourable person, others might not be and are more interested in getting money than doing the right thing.

Of course it's illegal/wrong to sell an exploit to third parties, but that doesn't stop people from doing illegal things as long as they get money for it. You just don't know about the issues that are sold because that's obviously not going public.
Btw, what is the process in contributing to libgd? I'd like to contribute.
What so what happens with the libs that aren't version controlled by Git... say Mercurial?
I think SF is a bubble and very unhealthy to the whole IT industry. It basically raises the costs for everyone.

It makes no sense to hire a person in SF for much more (and he will not really benefit from it) just because you compete with multi billions dollar businesses that can cut costs somewhere else.

At some point people do not want to change the world with next Instagram. They just want to live nicely.
Keeping in mind that I don't know much about Win32 and even less about UWP. It seems people are less worried about Win32 becoming unsupported and more worried about some new technology only being available to UWP apps (maybe something like the next version of DirectX?), which will force everyone to move away from Win32.
Gender/nationality diversity, politeness linked to higher SW productivity [pdf]
He did say in that video that he was going to show musk his tech was better than mobileye.

http://www.theverge.com/2016/6/6/11866868/comma-ai-george-ho...
Ding ding ding. The whole point of flirting is that it's a gradual (potentially) escalation path with a built in escape route / plausible deniability (for having a romantic interest in someone). It's like tossing across a thin fishing line and then the other person attaching a length of cord to while you pull it back and then attach a rope to, and so on. At any point any party can back down or back out without feeling hugely awkward or embarrassed, and to proceed it requires the cooperative participation of both people. It's quite an elegant system, in fact, it's a shame to many people are baffled by it.
Top Tools for Network Administrators: How Many of Them Are You Using?
It's really not that much. The outline makes it look like a book, but the truth is each of the 15 "chapters" range between a small and a medium sized post. Most of the subsections are one or two small paragraphs.
you missed the point: The point is, if the requirements for a piece of code are so complex that you NEED to write a requirement analysis, that you NEED to do anything other than plan out your code, and write it, than your software is already too complicated. You need to narrow the scope. Lots of small systems is better than one large system.
Yes but when the CO2 was vastly higher, solar output was lower.

The last major CO2-related warming cycle was about 50 million years ago. Most life on the planet died off, with what survived mainly near the poles. Crocodiles swam in the Arctic.
San Francisco's New Housing: Nooks and Crankies