skysight-inc/HackerNews huggingface dataset:
It's as remotely acceptable as "root" with no password, apparently.

The question is large and complicated, and people can agree to disagree. There's nothing wrong with tweeting vulns: The company is at fault, we can defend ourselves now that we know about the vuln, and it's a big PR disaster for Apple.

A past conversation: https://news.ycombinator.com/item?id=14009937

No, no it's not strictly more ethical. It's not even strictly safer, which should be an even easier question to answer. The baked-in assumption in your logic is that users have no options other than waiting to patch. But, obviously, they do, and keeping vulnerabilities secret deprives them of those options.
Yes, this is LLVM.
>Citation, please. I'm a Mozilla employee, and was a Mozilla employee at the time. I'm not going to claim everyone was ecstatic about things; there was a lot of soul-searching going on for some people. But I don't recall any "Mozilla employees", in the sense of people working for the Mozilla Corporation, saying they would resign, nor calling for Brendan to do so.

I'm not saying there was an organized "we, a group, will resing". I'm only repeating what I was told hanging out on the deck during one of the cantinas - that there would have be a lot of turnover if he hadn't left :)

IIRC Eich indirectly acknowledged this when he resigned when he said he didn't want to hurt Mozilla.
You can't expect everybody who uses a computer to be aware of that.
All too easily. There's so much to keep track of in modern systems engineering. We should all have a healthy dose of awareness that we could be/create that weakest link even on our best days.
The Ecosystem Expands for AMD Epyc Servers
think of the impact to shared iMacs on university campuses.

I'm sure Apple will in the future.
Probably the most prominent display of stoicism (well, almost a mockery of stoicism) is the Jedi Order in Star Wars.

...which also illustrates some of the problems of stoicism, IMHO.
Interesting seems like it will be very useful for providing SaaS offerings to servers that you want to keep extra secure by fully restricting internet access (Private VPC without NAT).

Not 100% clear if it is possible to enable bi-directional access for things like vulnerability scanning, but still seems very handy for a certain target audience.
Unlikely to be ET, but deserving of careful study. All extreme life is interesting.
Yes, I could, but you're the one making a claim.
...unless you set a password, right?
Typically any website that gets bought immediately enters its tailspin, but Meetup's rebranding (that gutted functionality) started that well in advance.
Perhaps ... I've spent 12 hours today with my kids, all but the first hour-90 minutes of their day (excepting school time for the schoolies; about 5 hours in the same space as them).

I didn't read the article but is this effect coming from father's doing more time as stay-at-home parents?

[FWIW we're dead poor financially at least in part through choice to have lots of contact with our kids.]
I'm on Sierra and haven't been able to reproduce. But does anyone know if it respects pam.d "nullok" and I could just delete that option?

/etc/pam.d$ grep -RI nullok /etc/pam.d
/etc/pam.d/authorization:auth required pam_opendirectory.so use_first_pass nullok
/etc/pam.d/checkpw:auth required pam_opendirectory.so use_first_pass nullok
/etc/pam.d/screensaver:auth required pam_opendirectory.so use_first_pass nullok
If we could actually get back to that model, having last-mile networking be a regulated title 2 neutral telecommunications entity (even municipal fiber, just maybe) and "ISP" be whatever service we connected to reach the wider internet, that'd be amazing.

ISPs could go back to being "information services", zero-rate, throttle, fast-lane, and generally do whatever they want, new ISPs could easily compete by popping up and connecting to the neutral backbone, and customers would have the ability to easily switch providers (just not the backbone).

IIUC, this is pretty much how the electrical utilities in Texas work, one local monopoly "distribution company" and a plethora of generating companies that consumers are free to choose from.
> When there is a merger in the works, use of burners and anonymous e-mail accounts are commonplace.

That's to prevent leaks from driving the stock price up, and causing the buyout cost to increase. That's a little different than using it to hide the fact that they were knowingly breaking the law. Do you understand the difference?
I learnt from psychologist that there are ways to help newborn to get asleep.

Newborn is in a very uncomfortable conditions for him. He used to be in a liquid environment. It was very noisy environment: there was a lot of sounds made by mothers body, digesting and more importantly heartbeat. It was dark there. But now he is on the air, he need to breathe, he hears silence with interruptions by some sharp sounds (in the belly sounds are different, I think there are no high frequences), and there are lights. Moreover first year baby experiences difficultes with thermoregulation of his body. Probably there are more things that trouble him, I'm not pretending to give you a full list.

Give him "heartbeat", give him a smell of his mother, ensure he is experiencing comfortable temperature, and he, probably, would get quiet. Try it with real mother first, let her take him, lay his head near her heart. If it works, get mother's dirty T-shirt and place it near nose of a baby. You can also try find some audio track, which makes your baby happy by sounding similarly enough to a heartbeat. The psychologist told a story of mother, who liked to walk near railways: her crying baby stopped cry every passed train, because he experienced noise level he used to. Moreover that was rythmic noise, like heartbeat. I don't think it is good idea to reach such levels of noise indoors at night, but you got an idea: do not make silence in his room, let it be some constant rythmic noise.

Though it does not work every time. Sometimes baby just don't want to sleep and get bored. But not in first few weeks: the first few weeks for him is a constant suffering of adaptation to a completely alien environment.
The Super Bowl Planning Committee's 26-year-old Wunderkind
I think gp’s position is that customer expectations of apple and windows platforms are different- that locked-down-ness was something that, when people could deal with it and preferred it, already were not the core windows customers.
Maybe this was why Tesla was being slow to ramp up their Model 3 production.
Major security flaw grants admin access on macOS High Sierra without password
"Familiar symbols or designs" depending on the country, wording may vary.

https://research.ncsu.edu/nctc/study-guide/infrastructure/re...

(Standard disclaimer: I am not a lawyer)
Trinity College to drop ‘freshman’ term over inclusivity concerns
When I put it into my personal malice / ignorance balance, it weighs out to the likelihood that the discloser isn't plugged in enough to the infosec scene to be aware that there are already best practices for this kind of disclosure.

It's a big world out there, especially nowadays. And nothing I've seen in recent history suggests to me the average user knows or cares about infosec concerns beyond basic hindsight understandings.
"T-Mobile treats all data the same, some data just doesn’t cost money"

I guess I'm too stupid to understand what "same" means.

It made sense to me, but maybe I'm the one misunderstanding. Let's try a hypothetical parallel:

PhoneCo sells you 1000 minutes of phone service, meaning that you can make 1000 minutes of calls without additional charge. But as a "perk" (to encourage you to convince your friends to switch PhoneCo), calls to other PhoneCo customers don't count toward this limit. You can still make calls to anyone you want, but the minutes don't always count against your total. I think it's clear what is meant by saying that "PhoneCo treats all calls the same, some calls just don't cost money".

Now assume we have DataCo, which sells you the right to download 1000 GB of data, but has a special arrangement with some partner companies such that data going back and forth to those companies does not count toward your limit. Again, you can still connect to any web site or data service you want, but for some subset of sites the data usage doesn't count toward your limit (presumably because those companies are paying something on your behalf).

Is it unreasonable to say that "DataCo treats all data the same, some data just doesn’t cost money"? Does it at least have a clear meaning? This is separate from the argument as to whether this is a good idea to allow, but I don't have much problem with the phrasing.
People are already fixing their machines because he tweeted. this is too much of a huge blunder to wait for the official channels.
Waymo Trade Secret Trial Delayed After Uber Accused of Sneakily Withholding
Then shouldn't the Earth Moon Lagrange points have bacteria in them them as well? Or Geosync satellites? Plenty of places to look.
Well, we could look at Go and Erlang.
Ask HN: Use Extensions as Facebook Page
Is it possible to use the Messenger Extensions as a page? Or, are there any third party tools that act as a wrapper around the Facebook Inbox, which has a quite poor user experience?
You hit the bullseye with this one. Parents remain unmarried in a monogamous, cohabiting relationship because the government pays them to not get married. Every benefit that has a household means test attached is an additional incentive to strategically realign the membership of your households.

So you designate one household as the mooch household, and one as the worker household. The latter tends to be ineligible for all manner of otherwise useful benefits, working full-time at minimum wage, and benefits may even be curtailed working part-time. The other can collect the maximum available benefits.

This also leads to some strange behavior in states that have common-law marriages.
I'm one of the paranoids. This is one of the main things I'm hoping for. Is there any indication of what price point such chips might be offered at? I have no idea how much it costs to set up fabrication, etc., but it seems like ARM chips have done very well.
Thing is companies like Netflix want to believe people are paying for seeing content, while truth is most people are paying for convenience. This needs to be drilled down to them.
On my system, the trick doesn't work. But then, I did explicitly set a non-empty root password.
Not cool to disclose this kind of bug on Twitter.
I am by no means an expert, but I linked to an article above that indicates that you were right all along.

Specifically "... is ejected from the station and burns ..." though there isn't much else to support for this.
Just had to chime in and say this was how it was when I worked in a Frito Lay warehouse. Lost 10lbs in my first week (probably water weight) because of the heat and labor required. Also same experience when working at Dixie warehouse. That is par for warehouse work.
But of those billions of other planets, as they get further and further away, the probability of an asteroid from them finding Earth goes down. So does the probability of life on the asteroid surviving the trip.

I think that the number of planets within a distance R is O(R^2), but the probability of an asteroid from such a planet reaching us is O(1/R^2). But if the probability of life on the asteroid surviving the trip decreases with a longer trip, the net effect is probably that the further-away planets contribute little to the probability of life reaching us in this way.
If the objection is to the technology: Lots of companies use special techniques to avoid creating a paper trail.

It's called "phone calls" and "talking privately". Using that to do bad stuff is bad, but conducting certain matters in a way that doesn't leave a paper trail is not by itself objectionable. I don't know any workplace that tries to ensure all communications leave a paper trail (though I did have a Facebook friend who insisted he only worked at such places, which must be false, since he's employed).
I have not been following this, what are the advantages?
They're not saying that C++ compilers do the best possible register allocation, they're saying that C++ compilers generate a register allocation that works and doesn't contain bugs. Technically, spilling everything to memory and loading only what you need to issue instructions is "getting it right" by this definition. No compiler strives to get the "optimal" anything in the general case, but we do expect them to strive to be "correct" in all cases. The language we use determines which properties are included in our idea of "correctness".
> sorry our site is better view with Google IE4... ehm Google Chrome

FWIW this is usually due to folks doing performance work in only one browser or not really testing well and slapping that label on after the fact.

Or stuff like Hangouts and Allo where they use nonstandard features.

The major things Firefox doesn't support that Chrome does are U2F (it does support it now, but flipped off, will flip on soon I think) and web components (support should be available next year I guess; this kinda stalled because of lots of spec churn and Google implementing an earlier incompatible spec early or something.)
It seems to activate the root user with an empty password if you try, as an admin user, to use "root"/"" as credentials in a System Preferences authentication prompt.

It does not work if you are not admin. It does not work if your root user is enabled and has a password set. If you tried the vuln, you should set a password for the root user ("sudo passwd root").
I don't have much in the way of ideas for you, but I did want to comment to offer solidarity. HN is full of bravado and braggadocio, and acknowledgment of holes in the software labor market is rare here. And here your post has been downvoted into the grey.
I can only hope it will blow over soon, like all the "nano-" bullshit from a few years back.
My Dominican Hair Dresser Kink-Shamed Me
Would love to hear from www.graph.cool folks
Not technically. Exploitation still requires physical access to the machine or remote access to have been enabled, right? Did your parents who don't read Twitter or HN enable a feature that generally only power users want or need?
my wife and I both quit.. I have a livly but not to often group text with most of my family - I drop a picture there. There is no real need for fb
Are black people innately hipper than white people?
> Disclosing an 0Day root authentication bypass vulnerability on Twitter isn't cool, even if it is local: think of the impact to shared iMacs on university campuses.

It gets the word out quickly.

Releasing proprietary software with such a hilariously insecure authentication system isn't cool. This isn't free software, produced by people & corporations out of the goodness of their hearts; rather, it's something for which people pay a good deal of money and which they have a right to expect is at least somewhat secure.

Getting the word out, fast that a) there's a huge insecurity and b) it's in Apple software provides benefits to those running macOS (so they can fix their systems) and to those considering running macOS (so they can evaluate whether an alternative is more appropriate).
> These companies have completely different operating systems, network ACLs, software update policies and subsystems that affect certain mechanical features.

Are you claiming that this could not have happened with Tesla? If so, please explain why.

> By your logic, we should not fly any modern commercial or military aircraft or spacecraft, live within a certain radius of any power or hazardous chemical plant, place any dependency on any first world country's health care network, including life support, or invest in any company or stock.

Up until now the benefits have clearly outweighed the risks, but that does not mean it will continue to do so.
Michael Arrington launches crypto fund
I'd say the change of the encoding stack to encoding-rs is pretty significant; while it's not that much code it's stuff that gets used throughout the codebase.
Maybe someone has access to the study this is based on and can clarify something: "The researchers defined a bubble as a sharp price run-up over a two-year followed by at least a 40% drop over the subsequent two years."

OK, so the claim is that Bitcoin is likely to drop 40% sometime within the next two years. My question is, what is the 40% relative to? Is it relative to the peak maximum? That is, assuming we are at the maximum right now, would the 40% be a drop to $6000?

I'm asking this carefully because "Bitcoin will drop to $6000" isn't exactly scary to anyone who bought Bitcoin more than a month ago. On the other hand, if the 40% is relative to some presumed stable plateau before the price run-up, i.e., to a Bitcoin price of $1000 or less, that would be enormous.

EDIT: Just to clarify, I understand that "at least 40%" can be considerably more than 40%.
TechCrunch Founder Arrington Raising $100M Ripple Hedge Fund
Generating Photorealistic Images of Fake Celebrities with AI
This is a much more interesting comment than your initial quip. Next time, consider leading with this rather than unnecessarily antagonizing people.
Encouraging users to "try it" is dangerous here. Recreating the bug enables root user across the system, and most users won't know how to disable it.

TechCrunch, if you're reading this... please discourage people from reproducing the bug.
One Bite at a Time: Partitioning Complexity
Wow, setting a root password seems to fix this...
At least the older one is being productive and producing content. Hey, there are some silly YouTubers who make real money from just streaming their life (games, fashion, etc).

Arguably, what they’re doing is better than sitting in front of a passive device like a TV. Sure, they could be spending their time more wisely, but the kids need some sort of down time (exactly how much time is for the parents to figure out).
Looks like changing root’s password blocks the exploit but if you disable the root user, it re-enables the exploit.

Protect yourself by changing root’s password: ⌘ (Command) + Space, Directory Utility, click the lock and enter your password, Edit -> Change Root Password…, then do NOT disable Root User.

Or open a terminal and do:

sudo passwd
https://www.collegetransitions.com/blog/college-legacy/

> A study of thirty elite colleges, found that primary legacy students are an astonishing 45% more likely to get into a highly selective college or university than a non-legacy. Secondary legacies receive a lesser pick-me-up of 13%. One study revealed that being a legacy was equivalent in admissions value to a 160 point gain on the SATs (on a 1600 point scale).

The end result of the legacy advantage can be seen on elite college campuses across the country. At Harvard, one-third of students offered admission have Crimson lineage. Fellow Ivies, The University of Pennsylvania and Brown also admit upwards of 33% of legacies, double their overall admit rate. Princeton, with its minuscule 7% admissions rate, has been known to admit over 40% of legacy candidates.
You have to realize that all these BigCo driven open source projects are really exploitation.

I would rather see an ICO model--where the community funds the protocol, like FileCoin or Ethereum--succeed than Google or Facebook taking advantage of the naive developers.
Could a programmer be held liable for any bad outcomes?
I think the question you're fundamentally asking is "are we ready for imperfect systems with potential vulnerabilities?", and the answer to that question has been the same since the advent of software.
I've used Meetup a ton, as an organizer and as a user, so I'm a little nostalgic about the good old days - but they've been over for some time.

I think EventBrite really put a dagger into Meetup five years ago or so, and proved that what customers actually want is not another social network but just a best-of-breed ticketing/booking/rsvp tool. I think Meetup tried for a while to pretend this was not the case, despite the evidence of groups fleeing their platform.

Interestingly, it's not just b/c organizers want to get paid. In my experience the only way to get people to reliably show up for an event is to get them to pay (even a nominal amount) and payments were just a bolted-on afterthought for Meetup.

I have some doubts that Facebook will come to dominate this niche, particularly when it comes to professional meetups/groups as many people keep their FB network and their professional network quite separate.
> I find it hard to justify developing Rust just for a web browser

"just for", our browsers are already very complex.

The browser is responsible for sandboxing and in effect taming the wild web.. and the web is not looking to become less wild :)

in the future browsers will have to prioritize CPU time between tabs seeking to mine bitcoin, crazy ad schemes, and battery power.

In terms of security, browser bugs scares me a lot more than some privilege escalation bug in the kernel. Because they can quickly be deployed widely.
Money quote: analysis of more than 5 million messages about Catalonia posted on social networks between Sept. 29 and Oct. 5 shows that only 3 percent come from real profiles outside the Russian and Venezuelan cybernetworks.
Good point. Been a while. Windows 7 also has/had an interesting one https://www.youtube.com/watch?v=zwO4YqSc4XE but it's much more involved.
Let's say keys were hidden around the neighborhood. Would you rather everyone in the whole town know about it or quietly and quickly go pick up all the keys before someone notices and breaks into one of the houses?

Personally I think if you report through the proper channels and nothing is changed THEN broadcast, but not as an opener.
My opinion is that DRM-supporting laws are not only unjustified, but their existence is also an impediment to true copyright reform.
I was wondering about that. I'm going to change this.
Enables root access in what way?
Personally, I've never needed to sign something restrictive with a recruiter before actually getting an offer. I've signed things far more restrictive after accepting an offer (non-competes, etc).

If you think working through a recruiter who requires that you sign something like this is your best option, and it's a lot better than any secondary options you have, then you may want to sign it.

If you do think you want to sign it, you could amend it before you sign (to dilute some of the constraints) and see what they do.

E.g. IANAL but you could try rewording:

replace

> __JOB_TITLE_HERE__ , San Francisco, CA

with

> __JOB_TITLE_HERE__ , __POTENTIAL_EMPLOYER_HERE__ , San Francisco, CA

You might also want to amend that and make the "exclusive right to present and represent me" clause expire after a short period (3 months?).

You might also want to amend the non-disclosure agreement to make it expire after some time period after you sign it (3 months? 6 months? 1 year).

Again, if you have no alternative to selling your labour through these recruiters, they might just say "no" to any amendments. If you would be a good fit for the employer and your skills/experience are in demand, you probably have a much better bargaining position.
Tested it in the terminal with "su - root". Doesn't help. Or does one need to reboot after it?
UPDATE: No effect after rebooting.
<sarcasm>"OSX the more secure OS because nobody tries to hack it, CONFIRMED."</sarcasm> ;)
I don't know much about OS development but isn't this just the sort of thing you'd automate testing for?
I think the interpretation of this is off. Less tired and less stressed translates to "more time with their parents".

Or perhaps more "quality" time. If a parent is too stressed or tired to give their full attention and engaging with a child, then this really does translate to wanting parents to work less.