skysight-inc/HackerNews huggingface dataset:
> The theft wasn't due to an issue in the core protocol of Ethereum

True enough, but what the parent pointed out is that this class of problems is due to a flaw in the core concept of Ethereum - which is much worse than just a flaw in the protocol.

To extend your analogy - Ethereum is like if a company advocated for building bridges using a process that made the bridge's integrity unverifiable using traditional engineering means. Some bridges may hold up, some may fail, with no clear way to identify which bridges will do what.
This whole crypto currency thing has an incredible bug bounty program.
In theory, yes. In practice, I don't know of any CA which guarantees continuity of intermediate certificates. In fact, some explicitly say they may rotate intermediates at any time. So the footgun is much worse than you describe: even if a CA doesn't go out of business, they may discontinue the intermediate you were pinning.

See here for a real-world example of what can go wrong when you pin to intermediates: https://cabforum.org/pipermail/public/2016-November/008989.h... (in this case, things worked out OK for the customer, but only because Symantec was willing to intentionally break the rules)
The problem is, how do you reassign the funds after the hardfork? The funds are attached to addresses and not persons.
What if the insurance doesn't pay out because it too is a flawed contract?
Thanks, it seems you are right. I thought that the ME plays some role in SGX setup but I can't find a single source for that now. Apparently it's all done with special instructions implemented in microcode.
Solidity is a pretty core part of Ethereum at this moment. It is demonstrably utter garbage, as this bug illustrates.
> If you hold a multisig contract that was drained, please be patient. They will be creating another multisig for you that has the same settings as your old multisig but with the vulnerability removed and will return your funds to you there.

It definitely is an uncanny read.
Posting uncharitably about life-and-death matters is guaranteed to be flamebait, so please don't.

Your comments have been breaking the HN guidelines by being uncivil and/or unsubstantive. Would you please fix this?

We detached this subthread from https://news.ycombinator.com/item?id=14805715 and marked it off-topic.
Why doesn't the only_uninitialized modifier cause a throw since m_numOwners should have already been > 0, no?
I would add one more point: even if both participants in a contract fully understand and agree to the contract, the contract could still be thrown out under contract law for many reasons -- unconscionability, agreement to commit a crime, etc.

If Ethereum becomes popular enough, one day the participants in an Ethereum contract are going to sue each other, and the judge is not going to be impressed by arguments that the contract is intended to be immutable. You can't opt out of contract law just by saying that you opt out of contract law.
Can someone explain how immutable contracts get updated? From what I understand you can have one contract forward requests to another, and you can use some storage in the forwarding contract to determine the real target contract. But why would someone participate in a contract that is mutable?

I guess I am just wondering how this contract can be updated, given its on the blockchain and considered immutable.
To My Fellow Plutocrats: You Can Cure Trumpism
This article is thoughtful and measured and doesn't even steer people towards startups.

It's fun to mock the man, but you didn't even bother reading the article. You should feel bad.
Except for DLC. A AAA title will need to ship at least 4 x DLCs over a 12 to 18 month period. And no doubt the DLC development will expose serious bugs along the way, so the DLC will have to contain patches as well.

The lifespan of AAA titles is longer now that most are purchased digitally.
Found what I was looking for!

Precision Dice.
http://www.bgshop.com/index-backgammon-dice.htm

They seem to be a backgammon thing.
how much money is that?
> The government should be in the business of meeting the needs of the people that put government officials in office. Full stop.

If the government wants to have fiber in rural Pennsylvania, it should build it. If voters won't countenance raising taxes enough to pay for that, well that's your answer. What it shouldn't do is try to end-run around the market, e.g. by forcing some customers to subsidize other customers, or imposing industry-specific taxes, or trying to get companies to build infrastructure by fiat. That just robs Peter to pay Paul.

Example: Verizon wanted to come into Baltimore to build fiber in competition with Comcast. Unlike D.C., Baltimore would not permit it to go neighborhood-by-neighborhood--the city demanded universal coverage. Baltimore doesn't have the money to build a network itself, and nobody else, including Google, would answer its pleas to build a fiber network on those terms. Baltimore is now stuck with a de facto Comcast monopoly. Meanwhile, almost everywhere else in Maryland has fiber. Who is served by that result?

> Is spending on ubiquitous access everywhere really a line in the sand for you?

The focus on ubiquitous infrastructure, rather than good infrastructure, is an anchor around the neck of America. E.g. it's why we have shitty train service everywhere, instead of decent train service along important routes.
I'm not sure I agree with that, obviously this seems to cause trouble if you have file names with non-ascii characters in them already, and who knows what else could have gone awry. But let's agree to disagree in that case :)
Did the doctor just say "Here, have these drugs" or did he/she prescribe the "potentially addictive" medication for a medical issue that should have been treated with that medication? Just not taking medication that your doctor thinks is necessary is not a good choice; you rarely know more than your doctor about the risk/reward profile of the medication.
It's hard to see a path for it to get more dangerous with time.
What's scarier? The price or the belief that there's a large enough market for this at that price?
Absolutely. A critique one could also point at TCI/IP before anyone running servers began to load balance their websites and other services.

Would you blame the the steel (or the concept of bridges in whole) for the Tacoma Narrows bridge waving in the wind?
> If you were the attacker and you now have the ETH in your wallet, how do you cash out without anyone identifying you and maximising your profits?

Exchange to BTC, mix it, exchange to USD.

> Also has the attacker broken a law by exploiting a bug in the contract?

There are no laws. Only contracts.
I think Casino dice just have to be good enough to meet standards, cost vs benefit. See my Precision Dice post below.
It's "cynical" to point out these problems will keep happening, but then they keep happening. So, not much to say.
"my favorite part of this latest ICO hack is that it appears to have gone to same wallet as the dao hack ....."

https://mobile.twitter.com/IamNomad/status/88777698177709261...

"incredible plot twist: whitehat hacker supposedly saved most tokens from being stolen using the same vuln."

https://mobile.twitter.com/bcrypt/status/887775417406431232?...

"Multisig wallets affected by this hack:
- Edgeless Casino (@edgelessproject)
- Swarm City (@swarmcitydapp)
- æternity blockchain (@aetrnty)"

https://mobile.twitter.com/maraoz/status/887755889897295872?...
This is the central, glaring flaw in cryptocurrencies to me. Transferring "value" for goods and services is really more of a social problem than a scientific/engineering one.

Money is a social technology that solves a social problem. Cryptocurrency is a engineering technology in search of a problem to solve.
Does this mean ETC is compromised too?
> Users of other kind of networks should not worry about this kind of hack.

The article is not about a hack. The article is about how the cell company or state-level actor can leverage the connectivity information that is required for any modern cell service to operate.
It's pretty common in India to take your new car to the temple and get it blessed.
~30 million USD.
Kraken, Leviathan, Cthulhu, no?
We already have "software", but please remind us why do we need "Ethereum" specifically?
Oh, yeah, I forgot. Dollars are much better; a central bank (actually, any bank) can create arbitrarily many of them and flood the other banks and the market with cheap money, causing things like the subprime crisis. Much better than crypto currencies.
Tumbler or transfer to another currency (possibly at a markdown). Specifically for ethereum: https://ethereum.stackexchange.com/questions/2699/is-there-a...
It's funny how PHP had it right all along. Serverless/lambda -> stateless "functions" being passed arguments -> same as PHP (w/o sessions and junk).

To be honest, when I jumped from PHP dev to more app-based backends years ago, I thought it was fairly crude to have a stateful server handling everything. Now everyone's starting to move back to (hosted) versions of what amounts to "bring up and tear down the entire app on each request."
The dollar depends on the willingness of the US government to keep servicing its debts, which would have real-world implications if it stopped. Indeed, political disagreements over this have already resulted in interruptions to governance and the availability of services, which is arguably equivalent to food shortages under communism.
The question makes sense, but really why do people have confidence in any of this, you know what I'm saying?
No, at least opioids don't work that way. There is no dose so high as to be guaranteed to be fatal -- it's entirely dependent upon an individual person's tolerance. There is effectively no ceiling opioid dose.
Most of us are not saving humanity in our jobs. We're helping some other people get rich (or lots of people save for their retirement).

What we put in is an expense and what we get out is profit. We should think of THAT like a small business in itself.

In that regard, while I'm not saying how many hours you should or shouldn't work it's something to bear in mind. Working your ass off when it doesn't stack up to do so is simply stupid.

Now for some stacking up could mean saving the planet. For others it could be earning enough to support their family and having some time to spend with them.

I believe family structure is important for the human race to exist. Growth at any cost has got us into the mess where we are worried about bailing out of this planet ASAP. It's a more nuanced picture than you seem inclined to believe.
Why wouldn't hard fork be able to undo this transaction?
> do things that are technically allowed, but have unexpected downsides

Unexpected downsides for whom? Smart contracts cease to be smart if we have to rely not on the VM but on a small group of human overlords.

If a smart contract exists and you don't know clearly how many times it has been used and what percentage of the parties who used it are pleased with its functioning, you really should not use it unless you feel comfortable personally reviewing the code.
How much overlap does this have with Kafka?
the robots will be doing all the driving by then
The bug in the wallet contract was fixed one hour ago with this commit: https://github.com/paritytech/parity/pull/6102/files/e06a1e8...

Parity bug: https://github.com/paritytech/parity/pull/6102
You can revert the funds to the address that paid into the contract in the first place, since transactions are public.
I have heard of a similar system in which two opposing teams are formed and argue over technicalities of the language used in front of a lifetime appointee with no particular experience of the topic who will decide the outcome.
Ask HN: Is there a market (both supply/demand) for half-time software engineers?
In the SF Bay Area, senior full time software engineers easily get a pay of around $150-180k base salary, not including benefits and stocks.

What I would like, and I feel like I can't be alone in this, is to be employed half time and get paid half of that. I'd like the flexibility of having more days to myself (at this stage of my life, i.e. starting a family, with priorities on family over work), and maybe even grow side projects into small streams of passive income to diversify my income.

I see a lot of pros on the employee side, and that there must be a pool of engineers looking for something similar.

On the employer side I see pros being that half-time employment doesn't require benefits like health insurance, so these employees are on their own, and they also probably don't get given stocks, so in total by paying 50% salary, you actually end up paying less than 50% of total cost for the employee.

The con I see for the employer is that part time employees don't count as exempt so are required to be paid for any overtime hours, meaning it's harder to get ops response type of work out of them (need to pay for OT). So definitely can't see a company running with only half time engineers, but perhaps having a subset of engineers be half time could be possible (maybe even a good cost-saving idea).

Having said all that, does HN think there actually is a market for this on either side?
Of course, there is a very large financial system designed to deal with the fallout of a bank password being stolen. There is no such system with crypto-currencies.
6% of a few billion is still a vast profit compared to their relative effort. It is not a bad thing either. Why shouldn't they make money? Profit is not a dirty word. Still @CryptoFascist makes a valid observation in stating that YC is probably not an impartial entity when writing about whether you should or should not start a start-up, preferably for them.
Depends on top speed. If you moped never breaks 25mph then a car doing 50mph could easily be less safe. It's also much more dangerous to people around you.
No sweat, it wasn't condescending.

I think for me, the problem is that my background is not in comp sci or software engineering. I am an aerospace engineer and am mostly self-taught save for what I retained from my first year C++ course back in the early aughts or gleaned from my sibling who is an ex Googler.

So I end up not grokking a lot of tutorials targeted at professional programmers, maybe?

I've written C, C++, C#, PHP, Python, lisp, Tcl, and Fortran and it was Fortran that presented the biggest hurdle in terms of finding quality info.

I sometimes wonder why nobody wrote a "Practical Common Lisp" for Fortran. Some artifact of the different characteristic Fortran user vs the Lisp user maybe?
A list of exactly what minimalists own
We detached this subthread from https://news.ycombinator.com/item?id=14805545 and marked it off-topic.
Except for that DAO of last summer, in that case the law changed...
Can't research be done on other countries? Has research anywhere, of any kind, determined ibogaine to be useful in the treatment of addiction?
> 6. Cross border

Worst possible advice.

Actually:

6. get in trouble and be detained for interrogation at border

7. Miss your flight / be added to suspect list / have your electronics confiscated / be denied entry / be sent to US prisons for an indefinite period of time without charge

You can choose more than one option for 7.

I had my phone inspected by border agent who found highly suspicious that I had no text messages stored in there, then asked me to enter the password to decrypt my messaging app then proceeded to go through the messages. I ended up entering the country because I knew of this possible scenario and had planted messages in there just in case. I know it worked because when given my phone back it was still open on the very message planted for the purpose of convincing the agent.

Also I mask my actual account on my laptop and create another with enough activity in it to pass for a real one.

I'm not going back to the US anymore in my lifetime.
You don't need money to start a startup. It is only startup culture which emphasizes it.

When you've got nothing, you don't have anything to risk, so those people without resources but with drive are as good a place as any.

My friends and I are working on something in the garage. It might not turn into anything, but when you only make 40k a year, it doesn't take much to be really successful. The thought of making an extra 20k a year is life changing for me and my friends. For a lot of people with great jobs or who are used to wealth, making less than 120k a year is a sacrifice. That's a huge disadvantage, and it becomes even more so when your entire company is filled with people like that.
Yes, and previous decimal versions had similarly powerful exploits.
From 9 hours ago: https://etherscan.io/address/0xb3764761e297d6f121e79c32a6582...
They reached a deal last year to stop complaining to regulators about each other:

https://www.recode.net/2016/4/22/11586336/microsoft-google-a...
I understand your counterpoint, but I don't think it's accurate. I mean, if it isn't verifiable, then how would it at all be exploitable, and then patchable?

Even so, any product designed for the network could be tested to death on any of the available testnets. It would be foolish not to ram any project up against everything in that environment, which is why I suggest poor practice as a primary cause.

It was an oversight, to be sure, and a major one. (that's not nearly strong enough language, but I want to be civil)
I'm sure they'll just hard fork again. And nobody cares because ethereum isn't actually being used for anything real, just a bunch of enthusiasts trying to get rich.
Not every startup is a an attempt at getting VC funds and make it big. Some startups are the least resistance way of getting something done or trying something new, that the incumbents aren't able or willing to try.
Bridge is particularly prone to being affected by poor shuffling, for two reasons. Firstly, cards of the same suit are clumped together as part of each trick, and if they are not separated during the shuffle, get evenly distributed back to the players. Secondly, suit distribution is important in bridge - it's normal to describe a hand by the amount of each suit it has.

Players noticed that voids and singletons were more common when playing online or with computer-generated hands. Unlike the board gamers of the article and everyone else who complains about bad RNGs, they had noticed a real effect, but the effect was backwards - the computer hands were better shuffled and more random.
Dremio Launched Today, Built on Apache Arrow, Calcite, Parquet
Honestly, I'd wager it's because Verilog and VHDL suck in a lot of ways basically. They work, but almost anything has better abstraction and reuse capabilities, even embedded DSLs or bespoke compilers or whatever, and offer better feedback loops during development. REPLs help a lot when building big circuits out of smaller ones. Being able to use a package manager to grab and manage SoC/IP components is convenient, etc.

Most of these DSLs tend to work at the level of RTL as opposed to something like "high level synthesis" where register usage is inferred, too (OpenCL, C, etc). So depending on how it's designed the results can be pretty close to hand-written code IME, without much overhead. They're more like "Super RTL" as opposed to real "high level" languages...
Start at block n-1, disable the buggy contract, leave the "stolen" funds where they were.
If you click though it says:

ETH USD Value:	$31,070,106.18 (@ $203.05/ETH)
Yes a standard would be great, with all the feature provide by those embedded HDL, but i'm realy not sure the industry could make it. #systemverilog
All moped drivers in cities wear helmets, only the passengers don't
Traffic speed is not constrained on the brand new inter-city freeways being built in India, though. I had that experience as a passenger not too long ago, and the high speeds + Indian driving habits were ... exciting.
Of course. As with any project, with the agreement of all copyright holders, you can relicense at any time. Facebook has already changed the license twice.

You could, if you wanted, fork the original Apache v2 licensed version that didn't contain the PATENTS file. (Although as per the linked article, why would you want to?)
I don't think what people want is random when they say that... they want intelligently mixed playlists that meet a few criteria. no back to back songs from the same artist unless the pool of songs doesn't have sufficient variability in artists, not too frequent repeating of the same song, if you have a live version of the song it should be lowered sufficiently in probability of playing when another cover/live version played. basically people want to remove repetition.
Silver lining: https://etherscan.io/address/0x1dba1131000664b884a1ba2384641...

Looks like about +300,000 ether was able to be drained before it could be stolen thanks to a white hat group.
It's pretty much an early nineties Sentra (B13 chassis), yes. There must be some minor production improvements that snuck in there over the years, one would hope, but definitely not much.
Personal information security best practices
Accessibility is way more important (to me) than noJS.

Given infinite resources I'd do all three but the with JS experience and accessibility matters more (to me).
Thanks for the reply, and good point. I guess I feel uneasy about letting the server "push" at will, for instance when dealing with mobile data plans. But come to think about it, I don't have much control on what I'll get once I visit a website.
Do you have used cars in Europe? The US is flooded with used cars and you can get something much better than this for $4000.
The most reliable mopeds still crash and get hit. Fatalities per mile are greater bicycles and motorcycles than cars.
If we enter a contract that we all know is intended to be immutable, why would a judge not enforce that? I can understand buried and obfuscated immutability clauses, but if the parties know exactly what they're getting into, the parameters of justice are contained.
Ask HN: What's your opinion on Toptal?
Hello,

I'm in an interview process with Toptal and I wanted to know if things changed since two years ago [1].

So basically :

1. Does anyone makes good money with the website ?

2. Is the technical interview worth it?

[1] : https://news.ycombinator.com/item?id=10107448
Driver's ed isn't cost-prohibitive, wages for drivers' ed instructors are relatively low compared to the price of cars, even these inexpensive cars.
https://technet.microsoft.com/en-us/library/security/ms17-01...

This is Microsoft's patch covering ShadowBrokers-leaked ETERNALBLUE SMB remote code execution 0day. The iOS 10.3.3 is likely the response to either the CIA Vault7 Wikileaks stash or the ShadowBrokers NSA EquationGroup stash. These exploits are probably out there in the hands of many people, and Apple had to respond.
They aren't made for external com
This makes sense to me - why would the user care what kind of filesystem their phones have - developers might - but when you cant choose the filesystem anyhow, what does it matter if the default changes.
> Can't you say the same thing about software that uses encryption in general? For example your browser, yet you still trust it.

Software in general doesn't exist in a vacuum - it's backed by all the centuries-old meatspace institutions like common law, courts, and lawyers that provide a recourse when something goes wrong. As I understand Ethereum's whole purpose is to replace a lot of these institutions with "smart contracts" (correct me if I'm wrong). If Ethereum has to rely on the same institutions as every other piece of software to deal with contract disputes isn't it just adding more complexity to transactions?