skysight-inc/HackerNews huggingface dataset:
It's been a long time, but I worked in a company with a call center in NC, and some support folks back in CA. We had some 'private pipe' between the two locations. I've no doubt it used 'public internet' connections along the way, but my recollection was it was somewhat separated, and we had some SLA in place. It wasn't pitched as "faster than the other internet", but I believe we had minimum ping times and minimum speed stuff in place, and when things were down we got some prioritized service (and probably some discount on the bill). It's been years, and I wasn't in the networking side of things, so I don't know all the details, but... I can't imagine hospitals that had a need for a certain level of network speed and availability couldn't contract for that already, and no doubt they'd pay more than home users any way (businesses generally already do).
I know these comments aren’t really allowed but I laughed
Not really; the issue is that you don't have a way to disclose how much the bug is worth without giving away the bug itself. You can kind of ask how much an exploit that gets a local user root access is worth, but that can give away enough to let them focus their own search.

In general, you have to rely on this being a repeated game - you and the pentester community at large submit lots of bugs to this company, and you rely on them to make it worth your time and talent. If they don't, you go test someone else's software. Reputation is everything.
Well, there's this data: http://som.yale.edu/news/2017/04/in-new-york-times-prof-jaso...
but it doesn't seem to be reaching the right ears. The thing is that a staggering lack of every kind of diversity persists within the tech sector. It is a much bigger problem than the occasional "wrong hire". There will always be some error... some bad hire that slips through any process as we perfect our hiring systems. The data from this study and the positive and highly effective blind orchstral auditions clearly show that we can still improve our strategies in finding the most skilled professional for the job. Perhaps we also need to work on expanding our notions of culture on the job and working toward becoming better engineers who can work with all types of people who want to produce great work. Perhaps you aren't aware of the closeness with wich orchestral musicians must work with stand partners, section members and the whole team and just how detrimental it can be for one person to have a problem so small as "plays great but moves around too much when playing" or "plays great but is an arrogant jerk during rehearsal creating bad morale"... and the thing is, we know there is probation review. It is an integral part of the hiring process. It isn't considered an error. We accept it as a phase. So why must software teams at companies with lots more wealth than a symphony orchestra expect to get it exactly right with a few wonky culture fit interviews and a relatively small whiteboarding section with the occasional take home project? They can and should find the funds to get serious about diversity in their industry. And frankly, with at-will contracts being the norm, every candidate is always "on probation".
This. My dad worked 70 hours a week and travelled for work 30% of the time growing up, but we never felt “he was never around” because he made it to graduation events and little league and called us every day after school.
This post reminded me of why Twitter is a pretty awful place.

The replies to this tweets are all everyones snarky comments to the @AppleSupport account or their edgy 'hot takes' on the issue. @AppleSupport responded promptly - albeit obviously out of their depth, and a bunch of people couldn't help but make fun of this fact. It's almost like tweeting to Apple's customer support account is not the best way to report a vulnerability?

Responsible disclosure has a proven history of working. When the vulnerability is appropriately patched and disclosed to the public, there is still a lot of backlash. You only need to look at the recent responsibly disclosed vulnerabilities for proof of this. Instead, we have a bunch of armchair analysts—who don't at all seem to be driven by past occurrences / existing data in any way—claiming that it didn't work.
RISC-V is certainly more unencumbered, but there's always the ARM architecture license too. Pricey, but you can modify and build on a relatively more mature ISA
Those numbers are in two different units: wealth is $ and GDP is $/time. Increasing wealth/income ratio could mean people are saving more.
One could even argue what was so enraging about Clippy (and MS's recent foray into helpbots instead of actual support) was the personality-sans-utility.

No, I don't want to forcibly converse with a brick wall that clearly doesn't understand my question and is chipperly excited about that fact, fuck you.

So I went from loving my latest Windows 10 PC (-- second in a row that had been awesome, even!) to swearing off MS for years (again) in about 30 minutes of completely terrible bot-based customer support.

I sincerely hope that strategy works for them, and they're gaining income somewhere to offset what they've lost from me.

I don't think it will.
These GraphQL provider offerings are great but it appears none of them offer a way to monetize[1] an API. Is GraphQL just not akin to this?

[1] https://apigee.com/api-management/#/products?jump=slider_gro...
Oh, the intention is good PR. Not donating to an already rich school for "further education".
Forget the company. This harms users, who are not responsible for causing these issues; for all except the most technical 1% of Apple users, keeping the problem secret while Apple works on a quick patch is much more secure than telling the whole world immediately.
I would argue yes, find a smaller number of paying customers and tailor the experience to them. It's incredible difficult to get paying customers, and if you can get some, then you can begin the journey of expanding your feature set / distribution channels / promotions to reach other customers.

It's kind of like the idea of focusing on fewer people who love you, vs lots of people who just like you, where love = paying customers :)
Agreed. Many people overdo it when it comes to supplementation, or eating too much of some hype crazed antioxidant food.
> and in very large part on the better web console

All I can say IRT this is WOW. The Google web console is one of the most painful UX experiences I've had in this space.
> Encouraging irresponsible disclosure because one wants to see Apple hurt is a reckless and selfish attitude because it puts millions of Apple customers at risk in the process.

Apple put millions of their customers at risk by skimping on QA. As an Apple user I'm OK with this getting out if it motivates Apple to improve their approach in the future.
Models in Motorsports – The ones that win you the race
MacOS High Sierra “root” vulnerability: user reported 2 weeks ago on Apple board
> You forget the majority of users are NOT technically savy.

Fixed that for you.

Sorry, I'm not going to cater to the lowest common denominator of "users". If my system has a hole, I want to know so I can get in a fix or shut down that particular feature until its fixed by a vendor.

Ive only 60k machines and 40 clients that depend on that decision. And they agree with me. If something's broke, I can analyse how it breaks and if it impacts us. If it does, we can triage it. I can do a damage assessment. I certainly can't do that if it's being sold on the darknets and whispered.
HDMI 2.1 Final Specs
It's not:

There's just a massive failure of leadership in tech companies (well, in general), so rather than deal with real challenges, they smother themselves in carbon-monoxide statistics -- things that don't set off alarms, but destroy the business through misoptimization.
Making Sure You Operate in the Cloud Marketplaces as an API Service Provider
When you are a large company, you outgrow the limits of a single AWS account per environment pretty quickly, and you start splitting out functional areas or services into their own accounts.

These endpoints solve the last piece of the puzzle, for having components communicate. Until now, we've had to do public ELB's with restricted security groups, or VPN tunnels.
How long have you been working in software? Bugs like this get past competent developers in reasonable organizations all the time.

Human fallibility, yo.
From 8 years ago:

https://news.ycombinator.com/item?id=722580
$250,000 @ %0.44 per day historical growth rate over the past 7 years.

https://cointelegraph.com/news/bitcoin-price-will-hit-250000...
Obligatory posting of Physics, Topology, Logic and Computation: A Rosetta Stone http://math.ucr.edu/home/baez/rosetta.pdf
Attackers being unaware of the flaw does.
Here's a pretty comprehensive, categorized list:

https://github.com/ripienaar/free-for-dev
What is the world did Waymo do that was shady here? Put something like that out there kind of need to back it up with something?
Yeah, i edited my comment because i did a quick search to see if they had implemented SNS filtering and turns out they did. I'll be telling my team about that tonight
Or more exciting, p = np
Drivers and risks of the cryptocurrency boom
Michael Arrington launches $100M cryptocurrency hedge fund
Radioactive material messes up certain types of fire detectors, and more advanced detectors detects also when they go outside their working parameters.

A plausible explanation would be that the garbage made some fire detectors in a power plant's loading bay to go offline.
That would mean that the bandwidth from the hard drive is a large bottleneck, which I have a hard time believing is true.
> A prototype is of considerable less size than 100.000.000 loc.

Yes? Agreed? It's simple, and yet it fails, because of management problems. That kind of management issue can happen to simple code or complex code.

Are you asking me to name a failure that's simple and large/complex at the same time? I'm confused.

Let me restate my position:

You originally brought up total lines of code. mikeash made a point that it's not total lines of code, it's code in relevant system, like ECU or the login service. I'm arguing in support of that point.

Complexity correlates with lines of code. But different subsystems can have different complexities. Especially when they're written by different teams.

The fact that the login service had special behavior wrt com.apple.loginwindow does not mean the complexity of com.apple.loginwindow is a notable factor. Com.apple.loginwindow was almost certainly not designed to enforce the security guarantees that the login service is responsible for. Its role could be played by either very complex code, or very simple code.

If the login service failed because of complex code, it failed because it was made of complex code. Not the total across the entire system.

Go ahead and pretend I never mentioned "systemic reasons" if it makes my argument make more sense to you. That was only about a possible scenario where the problem wasn't complex code. If complex code is the problem, then "systemic reasons" are utterly irrelevant. You don't need to argue that "systemic reasons" are complexity in disguise. Just delete that phrase entirely from my argument.
According to the workshop summary, they plan to ship a Linux capable dev board with hard U54 silicon in Q1 of 2018.

http://www.lowrisc.org/blog/2017/11/seventh-risc-v-workshop-...
Genetics and intelligence differences: five special findings (2014)
I've often found that Alexa doesn't even save me that trouble. It's useful for the useless things that I wouldn't do manually. The things that took a lot of time take even longer with Alexa (if they're supported at all), and the small things ... great, changing the lights now takes 3 seconds instead of 5 seconds, so I do it twice as often.

Voice is just a medium, what I really want is more powerful abstractions. Do more with fewer interactions.

I don't want to ask Alexa what movies are playing nearby, that's as good as the 1985 moviefone service. I want to know whether there are movies worth watching, and have Alexa check movies/times/ratings/weather/traffic/my calendar and tell me "Yes - X is certified Fresh and <friend> recommended it on Twitter recently. It's playing at Y theater for $Z, you can walk there in time for the 8:00PM show. Would you like me to buy a ticket?"... I don't want to buy an HDMI cable from Amazon, I want a sample of physical/digital retailers with prices/ETAs/ratings...

Voice, GUI, heck even CLI is fine.

And when it comes to smart homes, I expect learning and proactivity. If I follow GSW, don't make me ask if they're playing, then ask to turn on the TV, then change the channels, then adjust the volume... learn that I care, ask if I care now, and get the game on ASAP if the answer is "yes".
Why would thought leaders and well-known VCs want to do that?
> Disclosing this immediately puts those people who can't setup enable the root and set its password into more harm's way.

Let's be clear - Apple put their users in harms way by letting a bug of this nature slip past testing. Disclosing "responsibly" would certainly be nicer to users, but mostly it would be nice for Apple by helping mitigate the bad publicity.
Depends on your 'needs' and 'wants'.

For me there's a ~four-way set of compromises: Stock (or near-stock) Android, Headphone Jack, Excellent Battery Capacity, Quality components.

Unfortunately there's nothing that meets all four of those requirements.

The Google Pixel 2 is probably as close as it gets, but has no headphone jack - which is a deal breaker for me.

After that, it's down to either the Samsung Galaxy range (S8, S8+, Note8) which all have the Bixby button, or LG V30/V30+.

Both of these are unfortunately running heavily modded versions of Android that are well out of date, and the LG V30/V30+ have had issues with screen quality and general availability.

So, I have a Galaxy S8+ - not my first choice, and I'm not really happy with it (too much Samsung crapware on it), but it's better than the alternatives.
I've been through a rough patch (approx one year) with many similar symptoms. At the end it turned out to just be basically stress-induced Hypochondria. I was manifesting all of these myself, and what got me healthy again was to focus on other things, and basically letting go of those anxieties. Easier said than done, but that was all there was to it. Anyways all the best, hope you get it sorted! :)
Common Myths and Misconceptions about Thorium going ’round
“Evil”... I think the word you’re looking for is illegal (maybe not even that). There is not an objective moral code. I (and many others) view Uber challenging unethical laws as morally beneficial. I admit that’s my own personal opinion though and that there is no global concept of good/evil. Really odd to see this very conservative thinking creeping into the tech industry that in the past was very much against the establishment.
The weight of our possessions (2015)
> ... everyone ELSE agrees to accept them for goods and services. It's circular.

If you think about it, there is nothing circular about US dollar's supremacy. If you reside in the US, you are bound by the Legal Tender law -- meaning, by law, you have to accept US dollars as a valid payment for meeting financial obligation. The US dollar is also the defacto reserve currency of the world. All important commodities, for instance oil, are priced and traded in USD -- though there have been a number of bilateral agreements between oil-producing nations and consuming nations (eg, Iran-Turkey, Russia) to breakout of this, the USD still rules the day. If you want to understand how the US dollar became the reserve currency of the world, you do necessarily have to understand the WW2 (ie, military conflict), the Brettonwood agreement that came after the war, the collapse of the agreement in the 70's, and what US has been doing militarily and diplomatically to maintain their dollar hegemony since, but, in short, it isn't just about some arbitrary blind trust in the US dollar by the world (or circular reasoning) that we ended up with the system that we now have.

> How is the might of the US military relevant here? If you lived in South Korea, would you accept the South Korean won, or would you refuse your salary because their military is too weak compared to the United States? I would take my salary in South Korean won because all of my neighbors and strangers will take it in exchange for goods and services. Circular.

IMO, this is a terrible example to demonstrate your point. In case of national security threat or economic crisis, it's not uncommon to see smart monies fleeing to gold or other safer currency (eg, Swiss Franc, Japanese Yen, or USD). South Koreans are less likely to hold their own currency if the US decides to withdraw all 30K US troops and break any agreements in place to militarily assist the South in case of military conflict.
Things like frequent phone calls seen inconsequential, but: 1) They take significant dedication and scheduling on the part of the parent(s) and, 2) Have an outsize impact on the perception of your dependability. Huge from a kid's perspective.
I wonder if Bitcoin has more utility (potential) compared to gold though?

For example, if you purchase SaaS products with Bitcoin, you don't need to trust that the service provider or their merchant provider will handle your personally identifiable information with care (eg. billing info), because you didn't have to provide the information.

Perhaps there are other utility uses for Bitcoin that will eventually lead to demand based on something more than fear?
if someone has discovered a way to wipe anyones paypal account, should he disclose it privately or let it trend on social media? and lets say the fix will take about a day at the earliest.
Well sure. Banks prefer blockchains because it provides the properties of a SQL database that everyone syncs up with. And this complicated, sql database by another name is vastly vastly preferable to the stuff that banks are doing now.

Yes, the fact that blockchains act as a public database is way way better than the outdated stuff that banks spend billions of dollars on. But it is still not the 'innovative' and interesting part of blockchains.
Could you also write a client side graphql server to do the stitching locally? Is there a reason you wouldn't want to in general?
https://support.apple.com/en-us/HT204012

How to set root password.
It's worse. It shows nobody at Apple even tried to use app they are shipping.
A kiwi is nsfw?
A very small percentage of particularly tech-savvy users. The benefits to this subset do not justify the harm to everyone else.
Interesting, building graphql wrappers to Amazon apis, you mean?
Microbenchmarks specifically try to hold the rest of the world constant while measuring a microscopic piece of code, in the realms of countable cpu clock cycles. In that case, noise really is noise. And of course the data is of limited use.

Things like cache locality, branch prediction, prefetch etc. should be flushed out with a good microbenchmark prologue.
This isn’t about what’s best for Apple it’s about what is best for users. The way this was disclosed was bad for users.
The AWS AppSync pages are live now: https://aws.amazon.com/appsync/
Is it called Microsoft Windows?
Kent Beck – One Bite at a Time: Partitioning Complexity
People have been saying that governments are going to shut down bitcoin ever since it was invented. And yet here we are.

There are even conspiracy theories that the US government itself created bitcoin, for the same reason that the US navy labs invented Tor. To provide people in other countries with censorship resistent tools.
Yeah this is not like you have to craft special wireless packets to compromise the Broadcom network stack and then gain access. It's not that kind of vulnerability. This is really dumb and anybody can stumble across it. Hell, I work on network devices and non-production ones have root and blank as the password. I have tried the same in my laptop many times out of habit.

Responsible disclosure works when you are fairly certain you have found something nobody else knows about. Logging in with root must be known to many people.
Google eliminates Kubernetes fees just before the main event at AWS re:Invent
> I personally think the researcher should make the decision that best protects users from that specific vulnerability.

I find it odd that you're putting the responsibility of making decisions about how to protect Apple's users on an unaffiliated third party.

Apple has a multi-hundred-billion dollar war chest and, if they wanted to, could afford to make macOS the most secure operating system on the market. The fact that they don't is their own choice and a reflection of their priorities, not some act of God or a natural disaster. Putting the onus for cleaning up the mess in the most "responsible" way possible on third parties with a fraction of Apple's resources is being too kind to Apple.
Each to his own.

Kinda weird that it upset you that much.
Yeah, interestingly I think it's hard to understand what is going on with C because `T*` pointers can be used for many things. I found it easier to go to C after doing Rust because I had a deeper understanding of the semantics behind them. Was frustrating though because it never caught my mistakes!
While working at a pharmaceutical co I was backing up a drive onto the os drive of our local pc for general it support / utilities when I got a call from the user. She forgot to tell me she was on legal hold. I stopped the backup, went through the e-discovery process on her drive, rebuilt the pc and did e-discovery on our pc as well, because it was now also covered by her legal hold. You don't want to involve yourself in a case by ignoring those discovery laws, they are very serious about enforcement in court.
Their "preference" for "blockchain" is borne out of political necessity. I say this not to trivialize it, but to explain.

Banks are massive, massive institutions, and it is hard enough to coordinate people and resources within them, much less across them.

Back-office operations are indeed cumbersome and a major cost-center, and there is much value to be captured in simplifying all of it. If "blockchain" can serve a Schelling point to help get right people in these institutions to talk with one another so as to get on the same page, then there's a chance that some progress can be made towards solving these problems.

It's "blockchain" because "blockchain" is the new hotness, that's all. Any real world, inter-dealer distributed ledger will, in all practicality, be more like a cluster of SQL databases backing some kind of state-machine replication protocol than a cryptocurrency.

Happy BTC10k, by the way.
It’s no surprise because helicopter parents also don’t have their priorities or common-sense in order.
To be pedantic, this isn't a 0day root login vuln, but a priv escalation vuln.
Wait, isn't the point of having root you can erase your traces? Are these logs immutable, even to root? That sounds pretty next level.. and how do I trust the tools?

As far as I know, possibility of root = root = pwn, game over, time to format.
It is an interesting play. I didn't think WD would be all that relevant, but... I figured with open ISA the CPU would no longer be a significant piece of IP and competition and leadership would move to those with graphics IP. OTOH if tightly coupled CPU and storage was to become a big thing then storage companies would be the big winners (maybe just in some markets). But the fact that they talk about contributing back is interesting. If companies with GFX or storage want their specialty to become the real value, they will benefit by contributing high quality IP to the open CPU movement thereby destroying the market for the old guard (CPU makers).
My second favorite book I read this year was Sapiens which is also really good in case anyone is interested. I mention it because AFAIK, the book the person I’m responding to recommended is a follow-up of sorts.
Facebook is using AI to spot suicidal thoughts