skysight-inc/HackerNews huggingface dataset:
>> There's a lot of wishful thinking involved in this.

Yeah I agree, but the list of giant companies involved in the wishing is what makes it seem like more than a pipe dream. Just think how much revenue ARM will lose when WD, nVidia, Samsung and others all switch to RISC-V in their embedded devices.
Threads like this are always littered with advice to reinstall the OS of any computer you buy, and it troubles me. The vast majority of people have never heard this advice, and would have trouble following it even if they had.

Are we saying that only people technically competent enough to install an OS (plus a few close friends and relatives) can have fast, safe computers? Do we think that what we don't accept should be good enough for the rest of them? Or have we already given up any hope of solving it more than individually?

I don't have an answer here, but I'd like to see the discussion go beyond 'no probs, reinstall the OS' now and then.
And a year later, news that Uber knew about the hack but buried it.
The system for allocating airport slots is broken – Winning the slottery
If you disable the root user using `dsenableroot -d` from the Terminal, this seems to disable the account in a way that leaves its password intact.
If you think the team that makes animojis is the same team in charge of security or QA, I have news for you.
It’s always reasonable to assume that black-hats (and… what do you call government hackers — black-suits, helicopter-hats, ???) know everything that white-hats know, and that they either have or are already in the process of selling that exploit to less skilled criminals.

It’s not like being good morally correlates with being good at security.
They were already at risk.
People Are Building Their Own Tesla Powerwalls Out of Laptop Batteries
https://riscv.org/2014/10/why-not-build-on-openrisc/
I think it does. The statement is very clear and straight forward. It is a different statement than “you could be investigated by CPS for leaving your child on a parking garage.”
He is giving a technical talk to a large audience. Slides refer to development, and bio implies this means software development. Bio uses the phrase 'founder of software craftsmanship Turkey'.

Following the link to his home page we find:

"He has worked as software architect, software craftsman, technical leader, team leader, technical coordinator, Scrum Master and Agile coach in dozens of software projects at BYM, GittiGidiyor / eBay and Sony."

and

"Lemi Orhan Ergin is a Software craftsman, passionate developer, technical architect, Agile culture cultivator, Agile coach, Scrum / Kanban practitioner and trainer, Management 3.0 trainer, experienced mentor, engineering booster, Git trainer and lover, the TDD guy, clean coder, infected with the technical side of Agile, presentation and visualization freak, non-stop learner, full time apprentice of my masters, the community guy."

It's possible this guy was oblivious to the idea that there's a good way to share this information with Apple / The World At Large, and consequently did not attempt to find out the preferred way of doing it, but I don't buy it.
I don’t see it as either/or. You can disclose responsibly, and go for publicity once the fix is in circulation. Responsible disclosure is nothing to do with protecting Apple, it’s about protecting the users.
Or e-paper cards that can change face via remote app.

A bit like the deck used on an early James Bond film if I recall correctly, allowing 007 to win at the table.
There are a handful of scientists attempting to collect life forms from very high altitudes using balloons. In one instance [1] they discovered UV resistant bacteria. Could it be remotely possible that high altitude species have managed to live on the ISS?

[1] https://www.sciencedaily.com/releases/2009/03/090318094642.h...
i0wned
Although there is much to be desired still on the software end, the molasses of the situation is hardware support for the new formats. You mentioned it briefly, but there's only so much you can do with a software decoders. H.264 may not be ideal or technically have the best performance, but most video cards and cpu's have dedicated hardware decoders.

Completely unrealistic, but it would be interesting to have on the fly reprogramable FPGAs on die that can be assigned specific tasks on demand. This of course has tons of risks, but the pace that hardware moves is painful.
I would argue that releasing this vulnerability as irresponsibly as he did is showing he cares more about negative publicity than user security.

Yes, it's Apple's fault for poor QA that this was released, but this guy also put users at risk by telling the entire world about it without giving Apple a chance to fix it.

You're right, it's about user security before publicity. So make sure users are safe first.
I prefer reporting the mean and the standard deviation - the paper advocates a confidence interval instead of standard deviation. Typically, I'm more concerned with the spread of obtained performance values than I am with how likely it is that our measured mean is the within some interval. I generally don't think of that spread of obtained values as noise or random errors, but as systematic consequences of using real computing systems. The reason I don't consider that systematic error is that the sources of variation in real computer systems are often the result of things like memory hierarchies and system buffers that will exist in practice. Real systems will have these things, so I want my experiments to have them as well - so long as our benchmark has them in the same way a real production system will have them.

For example, see Table 2 in a recent paper I am a co-author on (page 8 of the pdf, page 73 using the proceedings numbering): http://www.scott-a-s.com/files/debs2017_daba.pdf In this paper, we care about latency, and we report the average latency along with the standard deviation. Here, a tighter standard deviation is more important than confidence that the mean falls within a particular range. And the variation in latencies is caused by both software and hardware realities of the memory hierarchy.
Thanks for pointing that out.

LLVM is one of the main things Apple gets to claim credit for, yet they aren't the only ones who deserve it.

LLVM is one of the reasons rust is so great, and the world is better because of it.
I had a friend who lived next to me with similar conditions, he was about 15 years old. He had a lot of weakness, stomach problems. Bloating in his stomach would cause headache. He would have bad itching in his body and his head (probably from the dryness), his hair were falling, and whenever he tried to stand up for a moment he said his vision and hearing would go away and he would see stars in front of him. Then they would come back. And his stomach problems would cause him headaches. The doctor in the government hospital here in India (who provide free treatment) did some blood tests and gave him some antibiotics. When it didn't work he just scolded his parents and told them to go away and just feed him well. Free health care can be like this in my country - there are just too many patients.

His parents could not afford private healthcare. So they decided to go to a local homeopathic doctor who used to charge half a dollar for a visit (compared to ten dollars for private doctors at that time which they couldn't afford).

Amazingly, it worked. It made him feel like going to sleep and the next day he was feeling maybe 50% better. Then he gradually became normal.

But placebo can be powerful. I have seen so many people cured by homeopathy - most of the times from problems that would need antibiotics or pain killers to cure, but sometimes other things too. Homeopathy is very popular in my country and there's a doctor or chemist selling homeopathy on every street.

Now I am not saying that it would work in your case, specially if you consider it to be a placebo and then that you already know it's a placebo. But it might be worth trying out.

You can do some research on the internet for the best homeopathic medicine for your symptoms. I just searched a bit for these symptoms and came across something called carbo veg. Maybe you can read about it and others, find one that you (and hopefully your subconscious mind) are convinced matches your symptoms and then take it. Order it in 30c, not even a single atom of the original substance is left at that point so what you chemically would have would be a drop of pure alcohol in water (hence it would not have any side effect). Ofcourse a homeopath would say that the water has magical properties , but all that doesn't have to matter. All you have to lose is maybe a few minutes of research to pick something that convinces your subconscious mind, and a couple of dollars for the medicine.

Just a suggestion.
is there anyone in that company who's not an asshole? the lack of any culture there is appalling.
> Pan Am estimated that between the ages of 16 and 18, Abagnale flew more than 1,000,000 miles (1,600,000 km) on more than 250 flights and flew to 26 countries by deadheading. As a company pilot, he was also able to stay at hotels for free during this time. Everything from food to lodging was billed to the airline company.

Simply unbelievable.

And interestingly enough, Dennis Ritchie is among some of the notable people to have lived in Frank Abagnale's hometown.

https://en.wikipedia.org/wiki/Bronxville,_New_York
In order to move the reader head inside your drive and to communicate with the host CPU you need microprocessors in your hard driver, really tiny ones. Now, instead of paying ARM for licences to use them WD is using open source processors that don't come with fees besides what it takes to manufacture them.
Washington files first state suit against Uber over massive data breach
In my opinion they don't "owe" anyone that obligation, unless it's a contractual obligation associated with using a Mac. But just because it's not owed to anyone, doesn't mean there isn't a nicer way to handle it just to be nice.

That said, I don't immediately see evidence that this gentleman is in the security field, and perhaps isn't aware of responsible disclosure. Full disclosure isn't the worst thing in the world.
There are kids books that at least might trigger a smile (very much more for the parents): https://amzn.com/1617750255

Hang in there!
Interesting idea. Thanks for the feedback!
Leaderboard – Keep track of your office games in Slack
https://aws.amazon.com/amazon-mq/pricing/ is a 404 right now and it still isnt listed on the main products page. Although from the screenshot it looks like its micro for $0.03 and large for $0.30 plus storage. Not an amazing price imo given how easy it is to run activemq, but not terrible either.
Far too many people think of Apple as infallible. I often think even Apple thinks of themselves as infallible. The more people that are aware of the inherent risk involved with using computers - any computer - the better.
If the mac has screen sharing enabled, physical access is not required
You expose yourself to currency risk as well with that strategy. I primarily worry about single company failures and wobbles; if the US economy implodes, the rest of the world will be caught up in it.

But you're right, you should balance with non-US as well. I've steered clear of them, myself, but that's not per se ideal practice and I'm overdue for a rebalancing.

But, to be clear, I was sketching an entry level into investing, not a more sophisticated approach.
> That yields as a minimum $97T in tax revenue per year

Total US GDP for 2016 was ~$18T.

It seems a bit unrealistic to me to think we can get 5x GDP in tax revenue each year.

So what is the catch?
I've not commented either way on the subject in this thread, but personally I would much rather have read this as a writeup 2 or 3 months from now after the discoverer had responsibly disclosed the vulnerability and Apple had a chance to patch it.

On the other hand, I'm glad that I have this information so I know not to install High Sierra on my work iMac (sitting on a desk in a WeWork behind a door whose lock would be very easy to force open) until this is fixed.

[Edit: I now see that there's a simple workaround (change the root password and keep root enabled), so I'm all for "irresponsible disclosure" in this case]
HPE Partners with COSMOS Research Group and the Cambridge Faculty of Mathematics
I guess Apple aren't the kind of company that would do it, but I'd love to read a frank post mortem about how this happened.
In Joel's defense, we don't know that gecko is better than X years of incremental changes to Netscape 4.

One of the big issues with software engineering advice is that it is really hard to find apples-to-apples comparisons for outcomes.
In general I've realized over the years that you are much better off if you can somehow get the customer to come to you, asking for your product or service (vs trying to "sell" to them). Of course easier said than done, but this is the essence of marketing -- perhaps make some noise in the right places so interested customers become aware of you.
Agreed.

iOS 11 was the tipping point for me (can't delete photos using trash icon, wrong orientation when unlocking phone, random lag/freezes etc).

Apple just doesn't care any more.
> admittedly low priority security vuln, passwords being sent over http

Wait, what?
Talk about buzzword bingo.
Judge Alsup got the letter because the US Attorney's office passed it along to him. I haven't seen anything about how the US Attorney obtained it, but presumably criminal prosecution and subpoenas provide a greater disincentive to lying than civil suits. Also, there were two parties who would have had this letter: Uber and the lawyer(s) who wrote the letter on behalf of the former Uber employee. Unlike Uber, those attorneys would have little incentive to be anything but transparent.
From your own cite:

>At download speeds of 3
megabits per second (Mbps), which is the Federal Communications Commission’s current
approximate standard for basic broadband service, 98 percent of the population had a choice of at
least two mobile ISPs and 88 percent had two or more fixed ISPs available to them.

And you're doubling down on nonsense. There's no regional agreements not to compete and your quote isn't any proof of it.
I suppose I'm arguing from a stricter reading of competition as a direct competition. Even expanding to "non-clone, innovative, disruptive competition", I still get back to in the case of a Netflix DRM is backed by contract law. Most of those same "non-clone, innovative, disruptions" would be "protected" against by contracts and license/subscriber agreements with or without DRM enforcing them. A lot of the arguments here about DRM stifling competition aren't dissimilar to complaining about how exclusivity contracts stifle competition. (Disney removing their entire catalog from Netflix in a couple years to give exclusivity to their own streaming service has much more to do with contract law than DRM.)

So too, the fact that you couldn't build a sharing service on top of Netflix has much more to do with the contract law and licensure of digital artifacts versus physical goods than anything at all to do with DRM. DRM is entirely orthogonal to the discussion. DVDs have DRM and that didn't prevent Netflix from building on top of them. What almost prevented Netflix from using DVDs was existing contract precedences with Blockbuster, but again that had much more to do with contract law than DRM.

DRM is a tool that is only as useful as law allows it to be, both for good and bad (how it gets regulated versus how it enforces legal structures). It does seem to me that many of the complaints about DRM are misdirected that there is no digital bill of rights and digital assets don't have regulations/protections that we take for granted for physical goods. Those problems remain even if W3C had blocked EME from becoming a standard.
I am more excited about this project https://github.com/AntonTheDev/ExtendaBLE

Disclaimer: Created by one of my co-workers.
A [?] don't know what you are talking about.
I just stumbled upon this website minutes ago and the comments on here immediately caught my eye. This place looks a lot like a poor man's Reddit but the discussions are on a whole other level; more focused and pithy, no jokes and memes. I really like it.
> "The fact is that the devs certainly do know about it by now, yet users do not have a fix yet."

Citation needed.

> "It is best for users to know that their system is vulnerable, and how to fix that without waiting for a system update."

Stepping outside the 'tech' social bubble, most general users likely won't create a root account and password from something they see on TV or their local news site or at least not before a patch would have been released.

--

Further to previously provided examples:

https://www.cloudflare.com/disclosure/

https://access.redhat.com/security/team/contact

https://www.xenproject.org/security-policy.html

https://about.gitlab.com/disclosure/

https://help.github.com/articles/responsible-disclosure-of-s...

https://www.kernel.org/doc/html/v4.10/admin-guide/security-b...

https://www.drupal.org/drupal-security-team/general-informat...

https://www.cisco.com/c/en/us/about/security-center/security...

https://www.juniper.net/us/en/security/report-vulnerability/
How many people are using the camera in pinned web apps? What's the app you use? I'd imagine most camera-related functions are already best served by native apps.
I can't stand article writers. Stop spreading FUD.
I loved "the kid on the left is me".
Southwest Airlines Is Intimidating Our Startup – Part II
link to source please?
Thanks for sharing these resources! Regarding your last point stating that "these technologies are at least a great way to prototype a backend.":

We've taken this feedback extremely seriously and are extracting the core of Graphcool as a standalone component which is a "GraphQL database". While it's not as user friendly (as of a visual user interface) it's meant as a foundation for highly scalable systems (based on the architectures you might find at Twitter or Facebook).

I'm very happy to hear more of your concerns and answer any questions!
I'm so excited that we're feasibly within a year or two of being able to develop embedded devices in Rust[0] on RISC-V microcontrollers [1] running on open source RTOSes also written in Rust[2]. It's currently already possible but still requires quite a bit of hacking. Plus the RF stacks (Bluetooth in particular) aren't there yet. What a time to be a developer. PS RISC-V on my X220 wouldn't hurt either.

[0] http://blog.japaric.io/quickstart/

[1] https://www.sifive.com/products/hifive1/

[2] https://www.tockos.org/
A URL parser takes a string with a URL in it, and returns some sort of data structure that represents the URL.

It's complex because URLs are complex; I believe this is the correct RFC: https://tools.ietf.org/html/rfc3986 It's 60 pages long.

(That said, page length is only a proxy for complexity, of course)
This is a civil lawsuit. Why would anyone go to jail?
The environment in which Erlang was developed was very different from the environment today. There were no third-party 4GLs available targeting the niche that Ericsson wanted, and there are good reasons to not want to use C in a telephone exchange.
They barely acknowledge bugs being submitted to Radar...
It's available in the console - pricing & costs(US):

mq.t2.micro $0.03 per hour

mq.m4.large $0.3 per hour

Storage $0.3 per GB-month

Looks like its limited to a single node or HA pair.
The code-snippet syntax needs only 2 spaces, actually.

But I like the original formatting better because lines wrap on narrow viewports (i.e. phones). It's frustratingly common that people post quotes with the code-snippet syntax and the lines are so long that stuff is nearly unreadable on mobile, unless you are masochistic and like reading in a scrolling viewport that only shows 40% of the line width at each time.
AFAICT, Apple's security bounty program is officially only for their preselected group of security researchers.

In the course of developing my current application, I've discovered a couple security bugs in macOS, which I reported to Apple product security in PGP-encrypted emails. The only thing offered to me was to have my name/company listed in the release notes (which they are, for the latest 10.13 update, along with a CVE#).
All programming is "automating check lists", when you think about it.
The defense will stem primarily from users invested in the Apple ecosystem. If anything that is very concerning on its own.
360 16K-stream-4K-viewport videos ? :p
Could someone explain, for someone not familiar with low level programming, what would be the advantages of using another garbage collector in Emacs?
I would move to aws, store assets in object storage (s3) instead of block storage (volumes), ensure your application is 12 factor and move it into an asg, move db to rds. Then start the process for moving from ec2 to k8s. That should give you a start.
I think there's a middle ground to this. Submit your report to Apple security, allow them time to develop a patch, and then in a week go ahead and tweet at the big media outlets about it.

I'm a die-hard Apple user myself, but I agree that the long list of severe bugs in High Sierra is absurd, and a big public backlash might be enough to kick them into gear. On the other hand, I, a university student with next to no understanding of computer security, can simply walk onto campus, sit down at a Mac, and within seconds have complete access to the computer. It's ridiculous, it's horrendous that it shipped like this, but it's not something that needed to get out, especially something so easy to utilize.
The main context needed is that Android is only a "Linux distro" when Linux fans talk about the installed base of Linux.
VPS Comparison: Vultr vs. Digital Ocean vs. Linode vs. SSD Nodes
I know lots of very successful business owners that aren't much more than normal/average when it comes to intelligence. They just work hard and provide a quality good or service to a market they understand. The END
Even though I see no reason to vote you down, there are a lot of reasons not to vote you up.

The message from WD is very good news for RISC-V. But to make the claim that it overthrows
all other architectures from the throne is not only a bit daring. With this logic, ARM should have crashed Intel a long time ago. There will always be a market for different architectures.

You have also misspelled RISC-V, indicating that you are not really aware of the market and architecture.
This reminds me of the jailbreaking scene a few years back. I was at an event centered around jailbreaking, and you were able to ssh into 80% of users iOS devices by using the default root password, alpine.
HP Enterprise is a different thing. Those big companies are customers HP actually cares about and they don't push things like this on them. They also honor warranties for them and respond to support calls.

The HP that sells laptops in department stores is consumer-hostile and sees the purchasers of their computers as cash cows to be farmed out to third parties and upsold remote support plans when the computer has a problem. And problems will inevitably occur since the machines are built with such poor quality control.

It's sad to see a brand new computer be slower than one that is 10 years old but can't be used because it has the wrong operating system.
The Blockchain Tech Stack
Great blog post, but I had to take pause at this line:

>Economist: More than happy to keep our discussion grounded to Earth.

Of course we can't just keep ramping up terrestrial energy production ad infinitum. All evidence points to us trying to leave spaceship Earth. The entire discussion was grounded in a reality we are trying to move past.