skysight-inc/HackerNews huggingface dataset:
But TFA says otherwise

>In Free Speech Coalition, the Supreme Court struck down a law that banned sexually explicit depictions of minors, as well as depictions that appeared to be minors. These included computer generated images and depictions of legal adults pretending to be minors. The Court recognized that the First Amendment “does not embrace certain categories of speech, including … pornography produced with real children.” However, the Court found the prohibition of images that appear to be, but are not actually, minors improper; any harm stemming from those false images “does not necessarily follow from the speech, but depends upon some unquantified potential for subsequent criminal acts."

Unless I'm reading it wrong.
GP mentioned that

> This was a crime entirely perpetrated by another party.

I think I didn't make myself clear. I, personally, do not think the people who actually exploited the vulnerability should be the main target of any law enforcement investigation.

What I want to build are strong incentives to ensure that vulnerable data is as secure as possible. Unless the pressure goes to the top, this will not happen. This means that it is not enough to find a scapegoat in mid-management who might not have much of a say in how things run.

I don't even hate credit rating agencies. If the CEO and the board go to prison (or a slightly less desirable outcome if they don't and we get strong regulations to make sure people do in any such future incidents) will make the rating agencies stronger. They will be able to go to investors and say look, we have to do things this way and it won't hurt your bottom line because everyone else has to follow the same regulation as well! It is just the cost of doing business. If they disagree, they are more than welcome to go to prison themselves for anything that happens.
How would FaceID be used to authenticate In-App-Purchases? Currently it's a finger on the home button, but I'd be somewhat scared if looking at the screen is all that's necessary to confirm a purchase. I'm pretty sure a second confirmation will be used, but I'm curious.
And many people are almost certainly going to find that they actually need to either recall an old immutable thing, or mutate it.

Also, I will certainly want to clear out my browser's cache on a regular basis. I do not want it keeping immutable things just because they shouldn't ever change.
Serious question: Why not acquire Tesla and position yourself leaps and bounds ahead of the other tech giants?
"I always say that given enough time, we can secure anything and find a way to say yes to it and business-driven CISOs are of that mind"

It's really a pretty balanced interview. This is what she said. There was a second interview, but I'm a lot more incensed that this information is being suppressed than at any one thing she says. I want to be furious when she says things like

"If a CISO can come up with a list of controls that he/she is comfortable with, then by and large the evidence proves that those controls are working effectively and are going to satisfy the elements of any framework that you use."

but all this interview really can show is that she knows some jargon, and her mindset. And I think it's really (truly, not in a figurative sense but literally) criminal that this information is suppressed. This is the case study of an interview that reveals insights from the mind of a CISO before disaster strikes... I literally don't even care that she was a Music major, how can anyone justify taking this down?

It's not just potentially criminal, it's also unconscionable. This should be preserved for posterity, I want to tar and feather the company, but I want to hear more from Susan Mauldin about what went wrong at Equifax.

I don't just want this interview back online, I want there to be a follow-up to this interview! And if it takes a pardon from Trump to make that happen, let's start the conversation.
Huh?

The weight is 45 tons going up, and 45 + 65 = 110 going down, right?

In a 100% efficient no friction wonder world, the load needed would be 45 tons going up, and 45 + 45 = 90 tons going down. This would balance out to 0 battery usage.

Since our going down weight is 110 tons and not 90 tons, we have 110 - 90 = 20 "extra tons" that can go to things like friction and imperfect conversion of energy forms.
Great idea for an ICO!
Yes. In the US being on the sex offender registry has deep negative impacts on getting housing, credit, work, and of course social life. This completely independent of /why/ you're on the registry. A felony does cause some problems getting work, but doesn't really affect anything else.
If a hacker can use just one CVE to break into your system and do a database dump (or equivalent), the system is architecturally wrongly designed and only being protected by a single layer of security. Which means, any one from the inside can access pretty much the info as the hacker, which is horrible.

For example, are the items in DB encrypted? Are database backups encrypted? Are different items encrypted using different keys? I don't think EFX did it right.
I keep hearing about this version of the singularity future where people lead intentional lives and eschew technology to produce handmade goods, as a way to find meaning in a world in which everything is automated. It seems the Amish are already there.
I can just watch them all for free.

http://southpark.cc.com/full-episodes/s13e04-eat-pray-queef#...

Perhaps they're blocked in the US?
And the MacBook :)
I don't understand why she put simply "Professional", but prior to Equifax she was:

- Senior Vice President of Enterprise Security and Chief Security Officer at First Data

- Senior Director of Information Security and Audit Compliance at Hewlett Packard

- Group Vice President at SunTrust Banks

- Vice President of Information Technology at First Commercial Brokerage

- Vice President of Information Technology at E&I Cooperative Services
1) keep an asset register up to date. This would include libraries used.

2) subscribe to a service that alerts on vulnerabilities in the assets listed in 1). Run Nessus scans. License cost you a bit over $1k a year.

3) invest in a resource to maintain the register and respond to alerts. Tie them into a governance model so management are aware of risks and can divert time and money when needed to mitigate

Security is a process not a technology. Nothing I've mentioned here is sexy or advanced.
> Everything is a crime in our neo-puritan state.

What is strange is how today's puritanism is coming from the left rather than the right.

Growing up as kid, I remember christians and conservatives attacking "Married with Children", "Simpsons", "Beavis and Butthead", "Southpark", etc. Even as an elementary kid, I remember associating christians/conservatives with censorship and for most of my life identified myself as a liberal.

The past few years, I've given up on liberals too as they are now pushing their form of censorship under the aegis of "social justice".

> Congrats, two 17 year olds sending pictures of themselves consentually = child porn.

It's even worse that isn't it? If a 17 year old takes a picture of herself on a smartphone and sends it to herself on her other accounts, then she's guilty of distributing child porn. Technically, isn't she guilty of distributing child porn of herself to herself?
Is there any more info on this? My impression was that neodymium permanent magnets synchronous motors beat everything else on power-to-weight ratio, especially regular induction motors (well, I guess Tesla's motor isn't "regular", but I still wonder how they achieved that).
you guys already killed it.
From the article:

“Did Freud get some things wrong?” says Lee Jaffe, the president-elect of the American Psychoanalytic Association. “Sure. But he also got many things right too.” Freud’s theories on unconscious mental processes, the importance of behavioral ambivalence and conflict, the origins of adult personality in childhood, mental representations as a moderator of social behavior, and stages of psychological development are all still relevant today. Freud also changed the public’s understanding of sex and desire, perhaps more than anyone else, by equating female desire with male desire. And, just by placing sexual desire and perversions into a “scientific” context, Freud freed sexuality from the largely religious context that focused on its moral degeneration or inherent criminality.

The ways in which he was wrong are much more nuanced than what you're suggesting.
Because Tesla is a money losing, capital intensive business they don't know how to run. See e.g. their Motorola debacle.
Oops, my bad -- the first link to the dupe should have been: https://news.ycombinator.com/item?id=15246659

Thanks for double-checking. Serves me right for trying to be helpful on my phone!
There are stories from other countries but not in the US since that referenced Supreme Court case afaik.
Got a cite?
Can anyone put this figure in context? I'm inclined to imagine that $1.1B is chicken feed for Google.
Even if they learn of a CVE there's no guarantee a patch exists for it. You might even be stuck with no alternative but to disable whatever the attack vector is... which could be key to your business.
With no friction etc you would just store all the energy on the way down and use it exactly the same (reversed) on the way up. 45 tons down is all you need to get 45 tons up. No extra. 90 tons down would get you 90 tons up.
Curiously, the US Army will take you at 17 (with parental consent). So you're old enough to decide to die for your country, but not old enough to decide to have sex with someone who's 23.
Ravens fans to be offered DNA test kits Sunday in unusual NFL promotion
You can change your name to avoid it coming up in Google, but would still show up on a background check, I think.
cf TSR2
Don't hire someone who majored in Music Composition as your Chief Security Officer is key.
Meh. Less than Hillary's presidential campaign.
I rather seriously doubt Elon is selling Tesla.
Much better read, thanks.

Mods might want to update the link?
Ask HN: Is there any way for two machines to talk over an untrusted network?
I realize Kerberos authentication exists, which requires a trusted third party. Is there any way for two machines to communicate securely without a shared secret or a trusted third party?
Google already has a huge amount of power over where people go on the Internet. It seems having power, however indirect, of where people go in the real world is their next goal, and it is quite deeply unsettling to consider. Imagine self-driving cars that will be cheaper but take you to "sponsored places" before going to your destination, refuse certain destinations "for your safety", and play ads continuously while you're helplessly transported around.

Given that amount of power they will have if they succeed, spending $1B on the (very real) possibility of getting to that situation is definitely expected. And very very scary for everyone else.
With parental consent, you can marry at much younger than 17 in most states.
Came into this thread kinda pissed, but after reading more about the case... it's wrong to send unsolicited nudes of yourself to someone no matter how old you are. The kid should definitely receive some kind of reprimanding. Jail? I don't think institutionalizing someone's mind over something like this is healthy... maybe just counseling?

And that being said, one must imagine how differently the case might have been handled had the genders of the involved persons been switched.
> I find myself yearning for the days of old.

How far back?

50% of your children dying before 4 back?

No antibiotics back?

No dentists all teeth gone by 35 back?

Slavery is legal back?

We as humans have a very good skill at seeing the good things about past times and glossing over the not so good parts.
Just south of Pittsburgh in the Mt Lebanon and Dormont area. My area was built up in Tue 1920s before having a car, let lone multiple cars for a family was a given.

I'm not sure what you'd call this if not a suburb. The exurban areas are the ones from the 50s on that are nothing but houses arranged in the worst way possible.

Honestly, a lot of the first and second ring suburbs are like this. The Mon Valley (suburbs and towns along one of our rivers to the south east) is set up like this, but has been decimated by the loss of industry.

(Mt Lebanon is a township so part of it does go down the super low density route, but not the older sections.)
I can't remember if it was Lazlo Bock or Eric Schmidt, but in one of their books (both?) someone reports a board member opining "You've created the first self-replicating talent machine." Having worked with those cats, that might actually be true.
Maybe because Google's self driving tech is fundamentally different than that Of Tesla's. Tesla relies on sensors and vision based system whereas Google relies on LIDAR. So I don't think they'd able to integrate the Tesla's self-driving tech into Waymo in any ways.
I knew a music major who is a Linux kernel dev hacker. I know someone who has a law degree who worked on the file system your probabily using now.

Don't be so quick to judge.
I'm not entirely sure, either. But I think the guy made a joke when testifying in parliament about the spy service being behind so far technologically that they had just recently bought a copy of "Internet for Dummies" to catch up.

In this article, it's supposed to set up the surprise that they were not, after all, completely stupid.

The translation is a bit off, I think. I can't really figure out what to make of all these apparently self-aggrandising statements, and I can assure you that no German bureaucrat would use the term "Yanks".
> e.g. I use the terms "Flag" instead of "Boolean" and "List" instead of "Array"

It some cases "Flag" makes much more sense than "Boolean", but when using logic gates does "Flag" make any sense? Wouldn't it make people think of actual flags more than an on or off signal.

"List" and "Array" mean different things in CS. Lists cannot be accessed arbitrarily whereas arrays can be.

> One can get pedantic over the exact meanings of symbols, but during the actual act of programming, simpler terms can help reduce friction.

"Simpler" is a matter of perspective. Any experienced programmer should not have any problem with Arrays vs Lists vs Queues, etc, and they are all necessary concepts to be able to talk about and program with.

Most jargon exists because it is able to describe things that are not used in everyday life much more efficiently than without it.
Is it really a matter of fault when the original question was 'who doesn't not 'why don't they'?
I found it for you... gimme a few minutes...

-----

Edit: Well, I found one video (11m30s), were there more?

-----

Edit:

From a quick check, this seems to be the same interview that was transcribed, though I'm not sure if it's the entire interview or even the one you were looking for:

80MB, M4V: http://evilrouters.net/media/susan_mauldin_cazena_interview_...

I'm uploading it to YouTube as well but I wouldn't be surprised if it gets taken down at some point.
But who teaches the previous generations and how? Chicken or egg first?

I think the origin is communication and memory. When a being (X) signals to another being (Y) the origins of its pain (signal of increased death probability) and X and Y can remember this cause, they can begin to teach.
Keep an up to date asset register before anything else. If you don't know what's in your platform then your running blind.
The idea that it is constitutional to charge someone with a felony for taking a picture of their own body is absurd. The judges were just too chicken to strike the entire statute. Actually, my apologies, that's unfair to the chicken.
The new “internet of co-computation” brings machine learning to IoT devices
which is why many of [technically] successful VTOLs were using propellers/fans - higher [static/slow-speed] thrust for the same engine power. For example Ryan XV-5 and Bell_X-22. That comes with other set of trade-offs of course. F-35 got the fan for reasons of balance and for the increased thrust, and be it my decision i'd do a second fan on F-35 instead of thrust vectoring, i.e. something more along the lines of Ryan XV-5.
Holy... In half of Mexico the age of consent is 12.
PDFs are a sub-optimal experience. Putting [PDF] in the link just saves me from wasting the time of clicking.
This one (from March 2016) is way better in every way. Not sure why this TechCrunch article even needed to be written now.

https://www.wired.com/2016/03/epic-story-dropboxs-exodus-ama...
What I wish is that houses were closer together and more of my property taxes went to creating nice parks which I could always walk to. I once met someone from Minnesota who just had some empty space behind their house that was fully closed in by people's backyards so they couldn't really build any more houses there. Apparently the HOA built a tennis court and a pond, which was used mainly for ice skating and hockey. Apparently their HOA fees paid for it and it was the most wonderful thing growing up.
ICOs, VCs, IPOs and SPACs
What about storing sensitive data in something like a HSM, which rate-limits access rate, so you could only lets say access 10000 records per day.

Yes, developing against such a system might be annoying (think about updating a new piece of data for all records).

But it feels to me that we need a way to rate-limit access to sensitive data, to prevent wholesale dump in a short time. But you still need other systems in place, to prevent a hacker lurking around for months until it gets all the data.
Wouldn't your traffic then be compromised at the VPN level, opening you to snooping from your provider? Or do I not understand something about how TOR encrypts its requests?
I totally understand that - but I don't expect those working at deeplearning.ai will be paid unfairly.

When the job description directly says 70+ hours expected, it puts you in a position to clearly say "Hey since this job will be roughly 70-90 hours, I expect my salary to be commensurate".

Its very different when companies don't clearly state that expectation - that is when the pay problems come in. Its so much worse to advertise a 40 hour job where candidates find out 3 months later how f* they are - those guys deserve the flak for overwork.
Tokyo is the cheapest long haul destination (Rio de Janeiro most expensive)
A 1940s era Lockheed Constellation cruised at 345 mph, the C102 at 420 mph. The difference on the C102's longest possible route (NYC-Miami) might about 3 hours 15 minutes for the jetliner and 4 hours for the Constellation. Meanwhile the Constellation

1) Can fly up to twice as many passengers.
2) Was almost certainly less expensive to operate.
3) Has over 4x the range.

If you ran an airline, which would you choose? And that's on a long route, on a 500 mile route the difference in flight time would be maybe twenty minutes.

And it was just a couple years from the DC-7, which was a turboprop that flew nearly as fast as the C102, was twice the size and also a massive range. And again cheaper to operate.

If the C102 had a 2,500+ mile range I think it would have a much better opportunity. Flying people from NY to LA at in 6 hours instead of 8 and at a much more comfortable altitude would be a much more significant difference.
I'll be the bad guy here and say that these laws should all just go away. It is just too convenient to plant "evidence" be it alcohol, drugs, or this.

The idea that minors cannot consent is correct. Children are not a scaled small version of adults. They need to develop not just grow physically and children are vulnerable. We need to protect vulnerable members of our society. However, like with so many things in life, we've gone too far though. We need to scale back this stupidity be it "for the children" or "terrorism" or "drugs are bad".

There's a quote about doing the same thing and expecting different results which I can't remember off the top of my head but to me all of this: including the drama against marriage and abortion feels like bread and circus to get people occupied with silliness.
If a hacker can use just one CVE to break into your system and do a database dump (or equivalent), the system is architecturally wrongly designed and only being protected by a single layer of security. Which means, any one from the inside can access pretty much the info as the hacker, which is horrible.

This is how it works at almost every company. Call it horrible if you want, but everyone stops short of describing in detail the exact architectural replacement. And when someone does, it inevitably has flaws that make it impossible to meet business goals.

It's too easy to handwave this away as "well, get a better architecture." Everyone knows that; the hard part is, what architecture? How does your architecture work in practice? Encrypting items won't help when the keys need to be stored in the same place to access the data. The attackers will just go after that box instead of the DB.

You can guard it more carefully, but the point is that some box somewhere needs access to a substantial amount of the data at any given time. It's the nature of a credit bureau.
The CVE and the patch came out on March 7. Exploits were already being detected in the wild at the time by perimeter security vendors. See http://blog.talosintelligence.com/2017/03/apache-0-day-explo...

Equifax "believes" that the hackers got in on May 13. They had some kind of intrusion detection system that finally detected the intrusion on July 29. 5 months after the "Critical" CVE alert went out. During that time security vendors were adding firewall rules to stop the attack. But apparently Equifax didn't have any other security in front of the Struts server.

That just seems like unconscionable incompetence and malpractice for such a high value target.
Based on her work experience she seemed qualified.
Mnemonic Not Working – Recovering Lost Cryptocurrencies
What happens when wrongly configured servers or frameworks with default settings implement this too aggressively? Browser vendors want their product to work as expected when the user hits refresh, so will be forced to either voliolate the standard or show stale content.
This is still true in the era of SSD?
I may be wrong (and invite correction if so), but I believe .onion addresses do not guarantee anonymity.

Servers on the tor network aren't some magical machines. They sit in the same datacenter as any other server, and all their traffic reaches them via the internet. Controlling the nodes connected to them should give you a pretty good idea of at least the magnitude of traffic they're seeing. And even without running any nodes, attacking blocks of IPs suspected
to include the service while measuring any potential impact on its latency allows you find their public IP (given enough resources and/or time).
Then, there's the attack of try
I agree that there is a larger problem. Taking it out on these guys is completely backwards.

Take it out on the hundred companies who advertise and pay for 40 hr workweeks while really expecting much more. That would be so much better for our industry.
Which is inexcusable. The Supreme Court is clearly corrupted and failing at its one job.... which is to shut stuff like this down and be a check on the irresponsibility of the legislative and executive branches.
What they did was wrong, but it shouldn't be prosecuted under child porn laws. They should get whatever punishment they'd get if they did the same at 18, under whatever harassment laws apply.
The Denial of Death by Ernest Becker has a few chapters about Freud. It's a very interesting perspective and I highly recommend that book.