skysight-inc/HackerNews huggingface dataset:
Edit: Okay so it seems that my shell based suggestion of `dsenableroot -d` prevents the bug from re-occurring, but not the GUI version. :facepalm:

I updated the post to include the word 'strong', although I would expect most users to simply set their own password, which should provide identical security to what they currently (should) have.

Disabling the root account does not open up the vulnerability again.

This vulnerability doesn't reset the root password, it only enables the root account and checks the password against that. The default root password out of the box on OSX is blank which is what allows this to work as-is.

By setting a root password, the next time you attempt this (and I tried it), the attempt fails since the 'root' account now has a password set.

Disabling simply puts the root account back in a dormant state, where it should be for most users, for after this vulnerability is fixed and it can't be enabled maliciously.
>removing NN is like gifting the ISPs the chance to further reward themselves for maintaining their monopoly

This is one of those things that seems to stick in the craw of some, as if when you "stick it to the man" you'll benefit some how. Notice how you used the word "force?" That is authoritarianism by definition. I think all technical people can agree that the goal is for our ISPs to behave in a way that conforms with the principles of net neutrality. Where we differ is how to reach that end. I am one that does not believe the end justifies the means, and that patience is a virtue.
That is not the case among infosec professionals either. Many respected professionals believe that the right thing to do in many cases is full public disclosure. Google Project Zero are a notable example.
We all can memorize a handful, but not 50 of them. That approach is cute, but it doesn't scale.
Why not Pale Moon?
Wow, so does it become released once an arrest has been made? Is arrest data public information in Germany?
It can already be activated remotely:

https://gfycat.com/gifs/detail/sentimentalnaiveantelopegroun...
the text of the quotes takes way too long to fade in. in fact, i'd remove the fade entirely.

otherwise, nice work, thanks.
No clues from me, but the problem is undeniable. Their stuff just does not work well anymore, and it has been so for a while now.
Drag your mouse over it to highlight the text.
Ask HN: How do you combat monopolies created by network effects?
With the recent discussion over the pros/cons of net neutrality, I've seen more than a few posts talk about the fact that companies such as Netflix/Facebook/Google/Amazon don't necessarily need preferred access from ISPs/telcos to maintain a monopoly. Instead, the posts assert that network effects are responsible for the monopoly -- the value of the service comes from the fact that your friends/family/acquaintances also use the service, and hence you will too.

To my understanding, in a traditional monopoly, such as Standard Oil, the way to break-up the monopoly is to break the company itself into smaller chunks that newcomers can more easily compete with. But how would that work for a Netflix/Facebook/Google/Amazon? If the network effects are that strong, what's the equivalent "chunking" action?

I'm assuming monopolies are bad in general and would rather not get into that discussion. My question is how to break up a monopoly that exists not from price fixing/vertical integration but rather from network effects.
Is Meetup popular outside of NYC? Every time I've looked at non-tech meetups outside of the area, the offerings seemed scarce.
Simple Habit is Hiring our #3 Engineer-iOS, Full-stack or back-end needed
It dropped because of the bitcoin cash/bcash/BCH fork. Some miners went to the new chain, for a while it was possible to game the BCH chain to get a faster reward, this meant for approx 2 weeks a lot of hashing power left bitcoin causing the next difficulty adjustment to be down. As the other commenter pointed out Bitmain have a bit of a monopoly at the moment but there is a new company offering chips soon so we could see a significant increase in the next 6-12 months as these chips come online.
That makes sense. Once a couple finds that their world view, values, and personalities are compatible, there is little else to evaluate.
Then you better remember the password you set, or be sure that you will always have sudo access.
Unlikely any AWS imaged employee MacBooks at least. AWS IT back in the beginning of October forbade employees to not upgrade to High Sierra.
1. Ensure you always have FileVault enabled (you should regardless) and shutdown after work until the bug is fixed.

2. Add a complex root passphrase and clean this up after the fix is released.

3. Reflect on how irresponsibly this serious security bug was ‘reported’, he didn’t just potentially miss out on $200,000, he put an enormous number of people at risk of local intrusions when instead if it was properly reported there’s a good chance Apple would have released a bug fix for this quicker thus reducing the potential impact and spread of misinformation.

https://en.m.wikipedia.org/wiki/Responsible_disclosure

https://support.apple.com/en-au/HT201220 (See ‘Security and privacy researchers’)
Announcing Arrington XRP Capital, a Crypto-Denominated Hedge Fund
I can see that point, although I would argue that if you include the language "We’re asking for an embargo on any stories" in the email, the vast majority of journalists will treat the contents of the email as under embargo. It's an unenforceable honor code, and most people don't want to get into semantic debates about what exactly is under embargo. But yes, the embargo does not go into effect until the journalists explicitly agrees to it, and that includes the contents of the email. Again, we believe this is the right advice for early-stage startups in order to garner journalist attention.
Integrating layout is a lot more challenging.

Now, once stylo and webrender are in play, ideally layout can just fit in between. All the interfacing already exists from Servo.

However, there are a lot more things in Firefox that talk to layout. This would need work, more work than Stylo.

But this isn't the major issue. The major issue is that Servo's layout has a lot of missing pieces, a lot more than was the case with its style system. It's hard to incrementally replace layout the way webrender did with rendering (fall back when you can't render, render to texture, include it).

So it's doable, but a lot more work.
Responsible disclosure does not prevent negative publicity. It provides the vendor with a grace period during which they can fix the vulnerability. There can be plenty of negative publicity once the vulnerability is patched and publicly disclosed.

Encouraging irresponsible disclosure because one wants to see Apple hurt is a reckless and selfish attitude because it puts millions of Apple customers at risk in the process.
I still think there is HUGE room for a service company that will wrap Amazon services in an economic way.

The value proposition here is incredible, you can save so much money for companies.

At my previous company, I changed one of the data ingestion architecture and saved 250,000$ in YEARLY AWS bill.

Of course, there are many problems with this, but I still think there is room for this. Right now, this knowledge is in silos in companies. Lots of companies should benefit from this.
For a local root with physical access? Not a chance. Maybe low 4 figures.
I don't see any evidence that this exploit is related to the GUI at all. The GUI just happens to be the easiest way to do it. Other commenters have mentioned that you can use the exploit with `su`.

In any case, in a desktop system you shove everything together and then try to modularize it with good design and weak tools like UNIX processes. In a car, the safety-critical systems are literally running on separate hardware with limited communication over a specialized data bus. Of course it's still possible for them to have bugs or even exploits, but the complexity of the infotainment system is irrelevant, aside from making it a potential jumping-off point for using an exploit in the safety-critical systems.

Counting the infotainment system here makes about as much sense as counting the number of lines in Windows when talking about a Mac vulnerability because a Windows machine could be used to launch an attack.
Assuming that the above list has a 10% chance of happening, that would be 10 times more remarkable than life starting on Earth in the first place; since you'd have the probability of adding water and heat to a (non-Earth) planet and waiting a few billion years for life and that whole list as well.
One day the kid may outsmart the sly, old fox. Hopefully, today is not that day!
MS announced they were abandoning Silverlight ~5 years ago now. Any platforms using it should be avoided like the plague.
Were there any academic obstructions to OpenRISC or OpenSPARC?
In any case, we know that they use special waste storage containers, and don't expose feces to space directly (presumably until these systems fail during re-entry - far away from the ISS). Take your pick of the several videos on YouTube that describe the ISS's toilet to see the waste containers in question.
You can read about it here: https://en.wikipedia.org/wiki/Labor_theory_of_value

I don't believe it is applicable to most of the economies on this planet.

If I may analogize, Buffett is saying that a trophy spouse that does nothing but look good and impress your friends (gold) is a less worthwhile investment than one that goes away all day to bring home $80 and a distinct grease-trap odor (stocks). A Van Gogh painting that hangs on your wall, slowly oxidizing its pigments (gold) is a less worthy investment than a plastic fish on a wood-veneer plaque that can sing four different songs whenever you walk past it (stocks). A square mile out in the desert with awesome sunsets and no light pollution at night (gold) is better than a square mile that grows corn, wheat, alfalfa, and soy when dosed with sufficient amounts of chemicals (stocks).

People value things other than money and rate of return, and other purely rational criteria. Sometimes people buy things to enjoy them as they are, rather than anticipate what they could be. The lump of gold will never be anything greater or lesser than what it was when you bought it, and some people like that quality. The 1 troy ounce .9167 gold coin will always be worth at least 1 troy ounce of .9167 gold, no matter what anyone else in the world does. If you bury 10 kg of .9999 gold and dig it up 100 years later, it will still be worth 10 kg of .9999 gold. You might be able to trade your gold for differently sized baskets of goods and services in different years, and the size of future baskets will always be smaller than what you could have obtained if you had wisely invested in companies, but you will always be able to get something, even if the world has effectively ended.
This situation is much more akin to a fire rapidly spreading through a village at night. I would go outside and start hollering in the hopes of saving anyone.
Reminder that SNS has at-least-once semantics, not just in theory but in practice: we have FaaS instances that see duplicates from SNS several times a day.

So if you are using SNS as a pub/sub bus for any kind of transactional activity (as in the examples above, where it's used for delivery of order_placed messages), be sure to build in some dupe-detection. The window seems to be on the order of minutes and I presume it's due to some distributed aspect of SNS internals. We keep MessageId history for a day for duplicate detection.

This is also why we won't use SNS for SMS to end-users, where a dupe would throw shade on us. We treat it strictly as a message fan-out for internal use.
Haven't used firefox since they shamefully ousted JavaScript creator Brendan Eich for making a donation. So forgive me for not getting excited about Rust.
This very excellent comment lies "dead", so I'll repost it:

asejfwe8823 24 minutes ago [dead] [-]

A better analogy would be "if the lending bank left the door to your new house open..."
Other than buy an Apple product, the users did nothing intentional to undermine security.
Since this is a subjective argument, based more on historical instances of "responsible disclosure" and not law, I'm gonna lean in this case of it being Apple that failed
They built the entire "walled garden" without getting outside help. They want the control, they have billions of dollars, can hire whatever talent...
Failed to spot a password-less root login issue.
People need to know today to be even more cautious about using Apple gear in public places or around plain ol' tech jerks that like to fuck with people for a gag.
Society has no legal or moral obligation to make sure Apple stays in business.
The loss of people like Avie Tevanian and Bertrand Serlet took its toll.

Are there any "(tech) household name" engineers doing system-level work on iOS/macOS these days? It seems like Google and Facebook have a slew of them.
doh, thanks. Can you tell what abstract data type I've been working with lately?
Even if you're on a dedicated machine, this vulnerability enables a local user to bypass the authentication prompt on things like System Preferences or other auth checks.

I'm advising folks (incl. non-tech) to set a root password and then re-disable the account (specifically via shell), which prevents this from re-occuring:

https://www.facebook.com/amar.sood/posts/10209545863036116
they are? Where's the fix?
On another note, XULRunner was a JS runtime with XUL for UI markup, like an early Electron. It's a shame the project was scrapped, I really enjoyed writing XUL+ES5 and seeing XML become native widgetry. (It's the platform that Firefox was initially built on, I don't know how much of it is still there now)

Bring back XULRunner :'( That project was way ahead of its time
> Had it been the opposite (half as much time), people would be accusing parents of outsourcing childcare.

It's not exactly strange for "X time allocation has doubled" and "X time allocation has halved" to both be bad.

If we back off the argument to looking at smaller changes, and truly looking at whether less or more is better... I'm not sure if parenting is special here. Maybe it's just that it's really easy to think of examples where people do too much, and examples where people do too little. So a change in either direction is a bad thing for those people, especially if they're more prone to follow along the way they were already going.
What's going on with Apple's QA team ? Here's another serious bug that I came across:

I've two factor authentication on my Apple account and now every time I use a new browser (or after clearing the Cache) and try to log into one of the Apple developer sites it sends me the authentication code to the same machine that I'm using. How is that two factor ?

I've an iPhone which is connected to the same account but it's not my primary phone so it's most likely not ON when I do this. I guess Apple tries to send the code to my phone and when it fails sends to the next online device which happens to be the same machine I'm using to log in. So all I have to do is click Allow and enter the 6 digit code which is displayed in a different app.
We need to come up with a witty name to get it fixed faster.
sudo passwd

Does that change the password for the current user without authentication, or does it change the password for root without authentication?

I think it would be best to recommend an unambiguous

sudo passwd root
PgDoctor: PostgreSQL healthchecks for load balancers
Frank Herbert's sci-fi classic "Dune". Amazing both for the entertainment value as well as for the thought-provoking ecological/sociopolitical ideas.
Works with El Capitan too.
Chatbots need a personality
I really wish this comic weren't so widespread. There's the legal protection of Free Speech in the United States and then there's the concept of free speech. This comic intentionally blurs the two in order to bolster the arguments of people advocating for "the right kind" of censorship.
Joel is making two separate claims there, though he doesn't cleanly distinguish them.

One is that rewriting from scratch is going to give you a worse result than incremental change from a technical point of view (the « absolutely no reason to believe that you are going to do a better job than you did the first time » bit).

The second is that independent of the technical merits, rewriting from scratch will be a bad commercial decision (the « throwing away your market leadership » bit).

We now know much more about how this turned out for his chosen example, and I think it's clear he was entirely wrong about the first claim (which he spends most of his time discussing). Gecko was a great technical success, and the cross-platform XUL stuff he complains about turned out to have many advantages (supporting plenty of innovation in addons which I don't think we'd have seen otherwise).

It's less clear whether he's right about the second: certainly Netscape did cede the field to IE for several years, but maybe that would have happened anyway: Netscape 4 wasn't much of a platform to build on. I think mozilla.org considered as a business has done better than most people would have expected in 2000.
Errr... umm... unit tests? Tests?
Meh, you're probably right. If nothing else, I'd want to verify the result of trying to use a disabled account (text in the dialog is localized, et. al.) Run through the scenario before I formally write the case and...WTF? Yeah, I could see that.
My guess: Market share. Go where the $$$ is. For AWS, if they were thinking about Apollo, they would be more likely to try and out-compete it before it gets a foothold.
I'm more concerned that the "exploit" works "after a few tries" and not the first-time-every-time, or not at all.

One would think that something as simple as a login would be deterministic.
Do they release statistics on bug bounty payouts?
Please let me know if it worked!
Tencent can’t even effectively enter non-mainland Chinese markets (HK, Taiwan, Singapore, etc...) or the countries surrounding the PRC (Cambodia, Myanmar, Vietnam, India, Russia, Korea, ....). Their scope is very china limited, where they have no experience competing with international contenders.
Thanks, a few folks have told me to just launch the thing already. I’ve been stuck in a “just one more feature” loop for too long. Probably ought to just give the stripe integration a good round of testing and call it v1.

And yes, I definitely need to work on the marketing site... I’m afraid I’m not the world’s best salesman.
This is precisely what rubs me the wrong way about the current pitches for net neutrality and why you won't see the right budge anytime soon. NN is being painted as a censorship issue by the biggest censorship-happy organizations in SV. To date, the only threats to consumers have come in the form of possible throttling and not outright blocking of certain speech. The only precedent I know of regarding censorship of the net has been at the hands of Twitter, Google and Youtube, Reddit, and Facebook, who are happily deleting all the political content they feel like at the moment whether it's illegal activity being discussed or not.

As my peer below stated, Comcast was caught disrupting P2P traffic which I hope gets addressed, but that's not how NN it's being sold and sensationalized today.

Edit: Clarifications
But a tweet isn't really the most effective way to tell everyone. Technical people, including those who would use this vulnerability for malice, will find out far far sooner than my grandmother.

It seems to me the right thing to do is to tell Apple privately, tell them to either push a fix or put out some kind of release letting all their customers know how to mitigate this in the next, say, 3 days, or I'll just tweet about it. What's the downside? At the worst case, you just prolonged the status quo for another 3 days.
Modern cars have a lot of electronics involved in things like steering, and some researchers already demonstrated that they can take over the steering of a car from remote by exploiting vulnerabilities in those electronics.
It's critical. One piece of advice though, don't worry about what the hottest tech stack at the time is, worry about how to solve the problems your customers are facing in an efficient and cost effective way. We thought about the type of data our customers would generate and how they would need to connect to our service to determine a tech stack that made sense. It was also important for us to pick a stack that as we grew we could find cost effective developers to work for us.
You have to think that whoever was responsible for testing this is going to get fired. This is egregiously bad...
The thing I ultimately don't get, and that makes this entire argument disingenuous, is that, if you believe that what Twitter is doing is wrong, then why on earth would you decide that you want to enable more actors, especially ones that people cannot avoid, to be able to do that?
That's exactly because people have treated the net like a common carrier. If the net is not a common carrier, you should expect to start seeing more censorship.

And there have been problems with ISPs - Comcast silently disrupting P2P connections, etc.
ok, sure, but in practice that is pretty unlikely.
Early manned space capsules dumped human waste (at least urine) overboard.

https://history.nasa.gov/SP-368/s6ch2.htm

No idea what the Soviets did.
And you might want to disable the root account again with `dsenableroot -d` as well, so that the root account stays disabled after the vulnerability is patched.

Unlike doing this through the GUI, this seems to retain the root password and prevent this vuln from re-occuring.
It's not irresponsible to make a bug public.

He did not put people at risk, he showed people they are already at risk, so they would know to set a root password, and thereby not be at risk.

Security by obscurity does not work!
This Is Why Health Care Costs So Much
Only the government has the power of 'legitimate violence' so they have to be considered in a different manner.
> force Fedex/UPS to ship at one speed only?

Certainly not.

But we should prevent them from charging 10x the rate for Netflix discs and giving free shipping to Blockbuster.
Project Zero does full disclosure 90 days after informing the relevant organization. Full disclosure comes after there has been a chance to fix the problem. Otherwise everyone is put at risk until a fix is available.
While the Windows API can be pretty clunky and has a ton of leftover cruft, and the UI-related APIs aren't too great thanks to being compatible with Windows 95 (use a toolkit if you want controls), it'd be really hard to argue that any of those (except maybe TempleOS; I haven't looked at it) are any more sane than Win32. You get pretty unified support for async notification through IOCP, which can be used for sockets, files and a few more things. On most of the systems you listed you'd get some flavor of kqueue at best, and probably only for sockets. On the NT side of things you have the handle system, which serve the same purpose as file handles without pretending that "read", "write", and "ioctl" are the only operation any of them will support (plus socket operations, if you want to include those). It also provides the ability to transfer them between processes (with access control!) and place them in a (semi-)global namespace without having to muck around with the actual filesystem.

Not to mention basic operations like reading information about a process doesn't involve having to parse text that can contain semi-arbitrary strings (/proc/<pid>/stat contains the filename near the start, have fun)

I can't say I like Windows as an OS, but API-wise? Not fantastic either, but compared to every other major desktop OS/kernel it's a saint, and provides more functionality. In the context of complex 3D games; if you need to do something like transfer 1GB of data from disk to GPU memory as fast as physically possible, you have to care about this.
Also, sleep when they sleep. If you think you can do chores in the first weeks think again.