skysight-inc/HackerNews huggingface dataset:
That's not a valid excuse.

The job of a leader is in part to identify and mitigate risks, or hire a competent person do it for you, while still being responsible for it.

The fact that risks of these magnitude were being mitigated by a single lone guy is a leadership issue.

Then, the problem was not only in the risk mitigation but also in the handling of the incident as well. That's again on the leadership.

Then, the exfiltrated information is not secondary to Equifax's business. It's the core of their business. It's not that they were Target, for instance, where the core of their business is retail... the proper handling of that information was Equifax's only goddamn job.
All written in rust :P
Mass Shootings Are a Bad Way to Understand Gun Violence
Saying "you're doubling down on sophistry" instead of just "you're wrong" doesn't actually make you more convincing.
Yeah, I should have finished this article when it was still fresh. Hardware always seems to catch up with codegen from the '70s.

(Thanks for the excellent paper reference.)
How about on ARM? Is its branch prediction keeping pace? I'm curious because you can't JIT to native on iOS, so finding the best way to build a VM there is interesting.
> Do these scanners ever work?

Yes they do. But you have to have a process to triage what the scanners produce, and have a team whose job it is to keep the ops/dev side accountable.

They are quite useful when scanning all the internal parts of a datacenter. There's a fair amount of nitpicking but it helps weed out the obvious (like installing some open source package which defaults to some bad cipher for SSL, or leaving internal links unencryped under pretext that it's "safe behind the firewall").

Often, though, the issues flagged by the scanner trigger deeper conversations about security. That's where the real value is, but that requires an organizational culture that actually cares about security. Instead, many companies just throw money at the problem of "security" and consider the scanner will fix all their issues with zero effort.
People that speak gloom and doom don't realize how many cryptocurrencies have already crashed and burned (from an investment standpoint). This market is absolutely ruthless, and any investor doubt is quickly seen in the market.

Examples (Percent down from peak)
BitShares - 80%
SiaCoin - 60%
Factom - 40%
Numeraire - 90%
Monaco - 65%

The list goes on. So for everyone who says this bubble is going to pop, I disagree. Bubbles pop every day in the crypto markets because there is absolutely no market more efficient than cryptocurrency. The strongest coins always win out in the end
Sounds like they're pointing fingers now.

It's funny. They should know that if a single employee can cause all that, it usually means they had some severe problems buried in their management.
the use may be declining, but only because oracle software is eating up more resources, and the open source software is getting better and requires less use to get the same job done.

you're all idiots.
> In short, reliable delivery of SMS messages internationally is still not solved.

So how does MessageBird solve this...?
What if you move? How do they verify your address is yours?
Oracle is a company like a tick is a person.
It pushes the average date out further. Just not everyone's.
That wouldn't be a "backdoor", but rather the system doing its job correctly. However it's obviously not the main goal.
You aren't their customer.
Send them a screwdriver first so you can bill twice.
Thanks alot, Bob. Over half the country's information got stolen and it's entirely and solely your fault.
$3B/yr in revenue; 9500 employees

One person responsible for the security of the enterprise.

If there is truly one person for a company this large, then he was setup to fail from the beginning. The management is negligent and incompetent for not creating a system for this. That's his job.

I think more likely, the CEO is full of shit and they're scape goating some poor person. But even if that's not the case, this is a terrible thing for him to admit. If he's really that incompetent, he has no business in management. Hopefully he never works in management again. Kiddo needs to go back to school, he's clearly forgotten all of his training.
Maybe it's not just a lack of empathy. Maybe it's selfishness thing with some rationalization on top.
Sorry to be that guy, but: I spend over $5m a year on rtb ads. I literally spend 50 hours a week doing this. If the money I spend doesn't produce verifiable results, I lose it.

For example, that 40cpm is to reach a pool of <1000 users who are in charge of purchasing for networks of hospitals, and my ads are for MRI machines. 3rd party data is unbelievably valuable, probably $1.5 million of my budget goes to data costs alone.
A couple of MOOCs or a bootcamp and they could make 80-120k in 16 weeks.
That's even worst. In most cases there are failures in multiple levels to reach to such a catastrophic event. If this hack is because of the error of a single employee, it means the have no safeguards or procedures setup to prevent such failures of happening. In other words he and his CTO have failed miserably at their job. A company should never depend on a single employee for anything.

Also we should expecting to be see more issues in the future.
Why is the contract code so hard to read? Bytecode?!
actually, if you only count adults with credit history, it more like 80%+
I would argue that is it far, far more important to teach kids how to think critically and equip with them with the tools to explore the world and learn on their own than saturate them with a bunch of facts and figures that they lack the capacity to intelligently comprehend and likely won't retain.
My reply wasn't meant to be disparaging in any way. It was to point out that your assertion that unthreaded discussions tend to be more focused and tight compared to threaded discussions isn't necessarily true.

Regarding the example I cited. it's an unthreaded discussion that has been going on for several years and, if you bother to read through it, it's a mixture of troll comments along with some informative comments/discussion. Had it been a properly threaded discussion, it would have been much easier to follow the informative thread branches and filter out the uninformative ones (where the classification of what falls under one category or the other is up to the person reading it).

But, because it's not threaded, you're effectively forced to wade through all the troll posts to find the informative comments (or miss the informative comments entirely if you're not willing to do that). The lack of threading did not change the "social aspect" of the discussion. It would have been the same either way given the topic, but one way of rendering it would have made it much easier to follow (and possibly spawned more informative discusson about the topic compared to what actually took place).

Getting back to your points:

> the very first comment is a message to the requestor telling them so. [...] after the message explaining that GitHub is not the correct place to make a pull request and that it will not be moving forward

If your assertion about unthreaded discussions was true, then it should have ended soon after that comment (maybe after a couple of comments from the person who submitted the pull request after Linus' comment). That obviously wasn't the case and nothing kept it in check.

> the unthreaded approach can help keep the discussion focused

Based on what I've read online over the years (both threaded and non-threaded discussions), it doesn't seem to be the case. The only way I think this could be settled would be to come up with a representative sample of discussions under both formats and how well they stay on the original topic compared to each other. It would be interesting to see the results of such an analysis.
I created this account to say: I have parents like yours. My parents took money from me. But fortunatly we are unusual. Most parents dont have to worry that they will face retribution for the times when they took money from there kids. It just doesnt happen that often. More often than it should but still not that often.
One of the World's Biggest Bitcoin Exchanges Just Added a New Cryptocurrency
That conflation is particularly slimy because works produced by the US government are explicitly, statutorily ineligible for copyright (17 USC 105). In other words, not only is there such a principle with regard to USG-produced works, it's been actively expressed in US law for decades.
Yeah, that's pretty bad blaming one employee when a single security hole on a single server resulted in the loss of personal information for 146 million people.
I can solve the dispute even more easily--I can just destroy the Aztec artifact. Viola--no more controversy.

Be careful wishing for something--you might get it.
Upload Images to S3 in GraphQL Using Rails and Paperclip
This is how the civil legal system is supposed to function. There needs to be some very large class action lawsuits brought against these companies, and huge awards need to be extracted in order increase the financial risk of having shitty infosec.
I figured you were absolutely willing to take questions from the general public.

Now, the average person seems woefully unaware of this. To them, the science and scientists seem unapproachable. They've stacked scientists up on a pedestal and fashioned imaginary ivory towers for them.

As a scientist, I have countless examples of such.

So, how do we let people know that you'd be delighted to take questions? Maybe one of those live BBC science specials would be in order? Something like that?

For all the marchers who believe in science, so few seem aware that they can practice it and be a part of it. They aren't even aware that they can be published without affiliation or a degree. Sure, it is harder, but they can and they can contribute.
RLY? The OP is a GH issue report with a really long winded thread, with lots of long comments.

I've scanned through the lot - what the blazes am I missing?
Decoding biggest success factor for startups
To compete with Rivals, Nvidia shares its secrets
It is still on the blockchain. You just won't be able to see it -- or you can always throw up another page to display the data
The first step towards this is having useful industry standards for auditing and certification that actually work... then you can think about an insurance market where insurers force certification.
From the brief: "the public interest favors an injunction, as there is a "public interest reflected in the Constitutional protection of copyright, and the congressional enactment of the Copyright Act, is enhanced by issuance of a permanent injunction where copyright infringement has taken place.""

Which public interest?

https://torrentfreak.com/images/scireportrect.pdf
I made something similar https://ethereumpixels.com not too long ago!
Had more of Reddit's r/place on my mind.
The source code for the contract and the webapp can be found here: https://github.com/EthereumPixels
Ask HN: Choosing between Influxdb and Elasticsearch
I am expecting my application to have around 100 concurrent users each writing around 125 time series data points per second. I have read some white papers on influxdb website that show that influxdb beats elasticsearch on several metrics (including data ingestion and query time). They also claim that influxdb scales well horizontally. However, the cluster version of influxdb is paid and too expensive for me. The application currently runs using influxdb on a single node.
Can I scale this with a single node installation of influxdb or should I consider influx cloud (cluster version) or elasticsearch. I would prefer the elasticsearch cluster as it is free but if it is possible to scale without actually creating a cluster then I would prefer influxdb.

Please note that I do not need all the user data in the same db so I can separate the data into multiple instances if required. All the users can have data stored independently if required. Any thoughts would be greatly appreciated!

Thanks
I can’t speak for a Fortune 50, but in the data warehouse space especially at massive scale, most options are closed source.
I love Stripe and used them for 4 years, but unfortunately have to use Braintree now because of Paypal.

Please Stripe, figure out how to integrate with Paypal. And my company is yours again.
From the article,

> "I was initially under the impression that my staff was sharing a copy of the Onion, until I realized this story was, in fact, true," Blumenauer wrote.
Is Bitcoin Compliant with Shariah Law?
> What is your objection to simply solving the problem?

Perhaps I don't know a perfect solution, but I know that top-down solutions often produce negative unintended consequences.

> rent seeking middle men who provide no value

I hate rent seeking and would love to see it eliminated from all sectors of the economy. But non-rent-seeking middle men often provide immense value to society, which is why they exist in the first place.

> slavishly devoted

Do you insult everyone you encounter online?

> Why is it unreasonable to have public funds go to publicly-available research?

I never said this was unreasonable, merely that it's complicated.

Of course, my "Silicon Valley economics" approach would be to start with a reduction in copyright regulations and privileges (along with patents for that matter).
Error, Singular?

One single employee developed the requirements for these errors, implemented these errors, tested the errors, documented the errors, and signed off to ship the errors.

What a piece of scum.
Neutrality is not something anyone should ever aspire to. It is something you do when it is otherwise correct, not something you set out to do. To do otherwise is contradictory and absurd.
Maybe. The separate domain might be explained by lack of trust in their PR company though. See Krebs' article: https://krebsonsecurity.com/2017/09/equifax-breach-response-...
Uber’s board clips Kalanick’s wings, clears way for SoftBank deal and IPO
Wow, I haven't heard of USDS before! But I recently used a website they apparently built (uscis.gov) and remember being very impressed with it. It surpassed my expectations for a government website by far: sane password policy, material design, easy to use navigation, well designed application flow...

Encouraging to see people with modern best practices in mind working for the government.
Thank you to the person that inlined the text to the PDF. Without this, Oracles FUD would have been tucked away as an attachment.
> and even if you do succeed, and have now hired a bunch of “rock stars,” you don’t have a team. You have a bunch of “rock stars.” In reality, rock stars typically don’t play well with others (consider these examples), and each member is typically just in it for themselves.

So by generalizing a definition of a rockstar as someone who sucks at teamwork, you too can write an article with a clickbait headline using 2014 slang and no real science.
I don't disagree with any particular assertion you make.

Let me ask the obvious question. What do we do then?

(If this doesn't spark discussion I'll gladly contribute my own ideas, which involve finding methods of partially-civil disobedience to even the scales of inconvenience a little bit.
I honestly believe a large issue in the current system is that there's no real pressure being held against any of the people with real power. Why would someone who can bring in tens of millions _FROM FAILING AS BADLY AS ONE CAN FAIL_ in their job, give a damn about anything but optimizing that number and minimizing time/effort spent to achieve that? With senate and house incumbency rates hovering around 90%, why would a politician ever deviate from the status quo? The wellbeing of the people is so far separated from any of their driving incentives, we must find ways to realign that.)
I'm torn between liking this view of personal data as property and also liking the view of Richard Stallman and the FSF that "intellectual property" is a legal fiction that we ought to resist. What does it actually mean to "own" data, and is "property" the best metaphor to represent a set of personal data control rights?
Html Blocks
Do you know if we have to give them our mobile phone number? Do they verify it somehow?
Well, this is what happens when people call for jail time. The moment someone goes to jail for something like this, it will change security issues forever: People will stop reporting breaches, and developers themselves will be at risk of going to jail.

Also, if you try to kill Equifax, companies will stop reporting breaches.

I don't know what the ultimate outcome of all of this will be, but it's important to keep perspective. People are out for blood, and it's both scary to watch and unsettling to think of the precedents it might set.
I just wanted to know if there's anything popular besides Oracle and MSSQL.
Getting business lines to sign off and invest the resources to update applications can be a huge challenge. Shiny new applications get all the attention, but maintaining and updating legacy applications is not prioritized.
He's got a point. Waymo looks like it's trying to shoot itself in the foot.

My interpretation of the judge's comments is that Uber is in a lot of trouble, if Waymo has a case at all. Which it looks like it doesn't.

I am not a lawyer. I am unaffiliated with the case in any way. Your mileage may vary. Not available in all states.
Why does Satya Nadella get a free pass on ransomware?
Yeah it was one guy, the CEO.
I'm not a lawyer but from what I've read, the Howey Test is more specific than 4 would suggest.

An unqualified read of 4 would count digital pokemons as securities. The effort has to be in the active management of the enterprise, and most of the profit has to come from this management - as you'd see in someone running a business - for the investment to be deemed a securities transaction.

In the case of Pokemon, or cryptocurrency, most of the value comes from the activity of the users.
Developers contemplating the risk of jail time may grow a spine and start refusing to do bad work.

Kinda like some engineers.
So snail mail isn't a good standard for email...what is a good standard?
Can someone explain how such an order is legal and doesn't violate search engines' first amendment rights? As a search engine how can I be compelled to comply with this when this case has no relation to me? Furthermore if I an forced to comply how is that not a violation of my rights to free speech? And why should I be forced to spend my resources essentially censoring for the U.S. government? Is it now illegal to link to sites that may or may not have copyrighted content? Am I going to have to follow every single U.S. case going forward and keep on censoring for the government forever? Last I checked, this wasn't child porn, just simple web links.
Although not a real hedge fund polychain flipped numeraire like nobody's business. (Check out the charts on that one)
Yeah... at least at $LARGEBANK I work at, FLOSS has been massively adopted in my tenure there. I do my part to evangelize as well.
Previous discussion: https://news.ycombinator.com/item?id=15343559

Good article. Well worth reading it in full.
There is an unpatched server at some IP address long forgotten and no longer used by Yahoo but still nevertheless works. The page still shows the Yahoo portal with news on the front page from when Yasser Arafat was alive. I believe the page has not been updated since 2003.

The IP address is in the 200 range. I used to remember the IP address for many years due to photographic memory even though I had only seen it briefly once. But I just cannot dig up that memory anymore.
He’s not a tech guy but he thinks he’s good at deals and wants to burn Obama’s legacy. I’m pretty confident predicting how that’ll go when one of the big contracting companies buys a membership at one of his golf clubs and gets a chance to talk about how much money he can save the government by getting rid of all of those expensive Silicon Valley types Obama brought on as federal staff. Convince the top executive and it’s really hard for staff to correct the salesguy’s misinformation (i.e. Oracle’s business model).

There’s also no way that Congress doesn’t have money pouring in, since that’s legal for contractors but not government agencies.

In either case, the actual results don’t matter: even if it costs more for worse results, a certain percentage of people think of privatization as magic and will support the image even in cases where it’s costing them money. You can see this frequently in businesses where the CEO sees only the savings in reduced headcount and is blind to the extra delays and failures.
As Brian Krebs reported in the "dumpster fire" article the response site was setup by their PR company. Perhaps they did not want to give away ownership of part of their domain... For security reasons
Language-independent code analysis tool written in OCaml at Uber
Totally false. A lot of open source software is MIT style, which effectively means there are no consequences to infringement. If the infringing code is GPL, then as customer you've won the lottery, because now you've got an irrevocable free license to everything tightly coupled to that code, and the vendor is limited to charging you for ongoing labor or for adjunct products. You have no responsibilities as customer except to refrain from preventing others access; if you choose to (re-)distribute the code, then you cannot constrain the recipients of the code. The vendor, on the other hand, is now required to charge no more than copying fees for infringing code, and must do so for any customer. They can charge for development labor and support fees (see: Red Hat), but derived code is available to you in perpetuity.
EY - Ernst & Young | Multiple Full stack - Ruby on Rails, | Palo Alto | Full-time- onsite

* Ruby, Ruby on Rails, JavaScript, React, HTML, CSS
* databases: MySQL, Postgres, Mongo, Redis, Cass

If interested, please send your resume to http://tinyurl.com/hackernewsEY
Not the CSO?
Bullshit. The USG has a the ability to leverage scale like no business ever could. The government consumes of tech are balkanized and sold billion dollar contracts over and over again when they could pay industry wages and still come out ahead.
I don't necessarily agree with him but I do sympathize on the security front. I know we all do our best in the OSS world but governments collecting all that data and not paying engineers to do formal verification and security auditing seems pretty scary.

Maybe this is a little backwards but there's something comforting about a massive beauracracy filled with paper forms and legions of administrators. It makes it quite difficult to run off with a billion records, doesn't it?
I am bothered by it, but I don’t think lack of regulation is going to fix the issue, because an ISP is a natural monopoly. The rights they have acquired from the government and from the private sector to lay all those wires provide too big a hurdle in the absence of regulation, and passing laws to make to easier to lay wires for competition would have to have all sorts of negative externalities for property owners and cities, not to mention the inefficiency of building the infrastructure twice. So that leaves regulating the current ISPs as a public utility, like is done successfully in much of the world, or leaving the market in the hands of monopolists.
Card shuffling and deck replacements take time, and time is money in a casino. Keeping an eye out for card counters and sharing blacklists with other casinos is cheaper than slowing down the operation of all their blackjack tables.
"The no-bid contract, which pays $7.25 million, is listed as a “sole source” acquisition, meaning the IRS has determined Equifax is the only business capable of providing this service."

If they are the only business capable why not make them bid anyway just in case?