skysight-inc/HackerNews huggingface dataset:
Developers are free to spend their time on whatever projects they wish, but I suspect that Waterfox users will quickly run into the tradeoffs between customizability and performance that the Firefox team made.

It's a noble effort but I suspect there just isn't a big enough community to keep a XUL-based browser (plus the extensions themselves) moving forward while being as secure, web-standard-current and fast as Firefox proper.
In order to create the test case that you would automate, you first must create the repro scenario. IOW, automation has nothing to do with this until the bug is found in the first place. Arguably, one could create a test model that might have found this but raise your hand if you even know what I'm talking about when I say "test model".

The only mitigation that automation would bring is if the bug was found in earlier versions, and test case was subsequently written. IOW, and very much a generalization, automation is to find regressions. But if the bug is new...

(To be clear, this bug still should have been found. But automation is unlikely to have found it.)
You think that if FICA went away employers would give it to the employees is so I have some shares in London Bridge to sell you
That's not something worth worrying about in your 20's. Just set up a recurring investment in index funds or similar and forget it exists until you're at least in your 50's or later.

Random catastrophes do happen to younger folks, of course, but those are something to deal with if and when they happen.
I didn't think the BSD's allowed a blank root password.
Maybe your points are correct.

But my argument is that there must be provable consumer harm, and that consumers are the only thing that matters.

So all those bad things that you mentioned, do they hurt consumers AND is Amazon actually doing them? That is the only thing that matters, and would be the thing that should be determined by whatever court case happens.
It requires the attacker to be able to type a few characters into a logged in session. If the session is not an administrative one, it's not fair to say all bets were off.

If I give you a Mac logged in with an unprivileged account and you can use only the keyboard and mouse to gain root access, the security has failed.

I think you've conflated this with the attacker having (full) physical access to the machine, which conventionally means access to its ports and perhaps a screwdriver. This is not that.
Not the case.

Once you enable root access - by 'testing' this - others can remotely & silently access the system as root.

GP is right - don't encourage people to test this, as there's nothing to gain from it. If you're on a shared machine you need to mitigate. If you're on your own dedicated machine you need to not share it until this is fixed.
since when? I've been running Nightly for months.
Just change the root password once the account is enabled; this fixes the hole.

sudo passwd -u root

It's sad we have to do this, though.
I was expecting something like this: http://www.dx.com/p/lomo-action-sampler-4-lens-35mm-film-cam...
Google Finance Tab
If you want to have a look at the console, they showed a demo on the twitch stream
https://www.twitch.tv/videos/205044748?t=01h21m05s
If that were true, then the security community wouldn't have spent years fighting about whether responsible disclosure was the right approach. That's for people who actually understand this stuff. It's unreasonable to expect an outsider to derive it all on their own from first principles.
The announcement does say "we are providing all of our RISC-V logic work to the community." Whatever that means.
Exactly, it is already sexist for the author to make such a generalisation.
You still haven't given a reason why "there's no rational way to value BTC" that isn't also applicable to USD. If you believe it's possible to rationally value USD, that would be a proof by contradiction that there's a way to rationally value BTC.
I'm also not sure those are the type of "PC" that was meant initially.

Though I could be wrong. Does HN get up in arms when people say Merry Christmas?
North Koreans Launch Ballistic Missle
Situation developing, please monitor here.

<3
The root account always exists.

Playing around with disable/enable and the exploit:
Root always has a /bin/sh shell
"Disable root user" removes the ShadowHashData from the directory services entry for root
The bug sets ShadowHashData to the hash of an empty string.

Now, ShadowHashData is a complex DS entry. I've never seen passwords represented this way in other OSX versions. I think this password storage format is new.

I strongly suspect the bug here is one related to OSX attempting to upgrade the password to the new storage format and when it does that, it inadvertently stores the password with a hash of null.

This should be very trivial for Apple to fix that (and thus "disable" the root user) by just removing any ShadowHashData that is solvable by an empty string.
There are "instruction set architecture" and "microarchitecture" (=specific implementation of an ISA). ISA is the one more commonly referred to as just architecture, I think.
I've never deprived someone of something they own or committed any kind of mayhem on the high sea.

Generally, I pay for whatever content I download. I'd have to do some research to figure out how to rip a Netflix stream or export recorded video from my DVR. Ripping DVDs (and especially Blu-Rays) takes a bunch of time, and encoding the result can be hard to get right (embedding subtitles, choosing a codec and profile that works on most of my devices, etc). It's easier and faster to torrent it than do all the ripping and conversion myself. Not that I do it much anymore; I suspect that format-shifting wouldn't be a good legal defense. And I also suspect that my ISP (the only high-speed one in the area) would dump me as a customer at some point.
Apple never supported any free codec, be it Vorbis, Opus, VP8 or VP9. I don't see why they would change their attitude with AV1.

Nobody is going to wait for them.
>For the rest of us, Netflix and the major content studios begrudgingly allow us to watch 720p video on our way too open computers.

I wish they even gave this, but at least in here, many mainstream flicks are of even worse quality (although this restriction on some content seems to apply even on Windows and Edge browser, at least on my computers). Not that it really matters what's the nominal resolution of a 1000 kbps stream anyway (and lately Netflix has removed the option to see the actual resolution of the video I think), however...

... selling out the free web got us so much indeed.
See this is the problem with the pro NN side. It's littered with factual inaccuracies and outright lies. ISPs, in the US at least, have not agreed to not compete with each other and there's no regional monopolies. The majority of the country has 2 or more broadband providers plus a plethora of wireless and satellite options.
It's the Trump strategy: do sleazy and illegal things at such a high rate that no one can keep up with the firehose. They know apologists will bamboozle the public by taking each instance in isolation and going "it's no big deal", and it works because no one has enough working memory to keep the whole picture in their head at once and be appropriately outraged enough.
There is also SeaMonkey, how do waterfox and seamonkey compare?
Dupe. https://news.ycombinator.com/item?id=15800676
Do you honestly think that has anything to do with my point?
The issue is that the bug leaves a password-less root account available through other means as well. Once you try to reproduce the bug, an attacker could potentially do a remote root login without password.

As such, it's very dangerous for people to try to verify and should be strongly discouraged.
No, instead it should be a cabal of ten tech executives with names like Brian, Lowell, Marcelo, Thomas, and John - you know the good ol' boys who have made Pai rich and have jobs lined up for him as soon as he retires from the FCC. Those silly new-age-tech guys don't understand how the game works, and think that the constitution has any place in our "Democracy".
Triangulate between two detectors?
LLVM started out as a research project at the University of Illinois, but Apple hired the lead developer in 2005 and put a ton of work into making it good enough to replace GCC. Apple also originally wrote Clang, LLVM's C/C++/Objective-C frontend, though Rust doesn't directly rely on this part.

Calling it "Apple's" threw me off too, but it's not entirely misleading because without Apple, it might not have become a production-ready compiler. At the least, I would say Apple did more than "just use it".
There are thousands of ways you could test this. Like most tests, having them isn't the same as having good ones.
That explains why I couldn't get it to work on my machines that are still on Sierra. I'm glad I've put off the update.
We completely agree. This has been on our TODO list since Sept 2016: https://github.com/ProjectSidewalk/SidewalkWebpage/issues/28.... We are working on it!

Note that we are a small, academic project with no professional developers. So, unfortunately, some TODOs take longer than we expect or want.

Thanks for the comment and for the nudge to work even hard on this!
I used to have horrible panic attacks, waking up out of a seemingly sound sleep. Turns out I have central sleep apnea. Took ~28 years to figure that out. Completely gone with SA treatment.
I've been using it too, especially since FF 57 for some reason breaks images on some websites. I've also been using Qutebrowser some, which I love for the keybindings.
"On Thursday October 24, 2013, an Oklahoma court ruled against Toyota in a case of unintended acceleration that lead to the death of one the occupants. Central to the trial was the Engine Control Module's (ECM) firmware.

Embedded software used to be low-level code we'd bang together using C or assembler. These days, even a relatively straightforward, albeit critical, task like throttle control is likely to use a sophisticated RTOS and tens of thousands of lines of code.
" [1] [2]

[1] https://www.edn.com/design/automotive/4423428/Toyota-s-kille...

[2] https://www.embedded.com/electronics-blogs/barr-code/4214602...
I see this as an indictment of the common business management tactic world-wide to externalize the costs of rising expectations placed upon employees, without compensation, under the "do more with less" rubric. When even the children can see what is plainly in front of them, and express in honest language that their parents are bringing home work responsibilities and concerns, then the economic platform should be re-examined.
Serious Apple MacOS root with blank password bug
My impression has been that the way bands make money is not from selling their music, because the record company takes most of that money, but rather from going on tours and selling people expensive tickets to experience something which is fundamentally impossible to experience through piracy.
On what basis do you "guarantee" this?
Seamonkey is much older, and not really a fork as it follows current day Firefox development quite closely.

Hell, one may well call Firefox a fork of the browser part of Seamonkey.

A more interesting comparison to Waterfox would be Pale Moon. And there is also Basilisk, a more recent project by the Pale Moon people.
Neither. I'd rather her do her banking on a machine that she has full control of: linux or any other foss os
This vulnerability lets users activate the root user without using their password.

Once done, you have opened for root without password globally. That's bad.

What they should do, as responsible disclosure dictates, is report it in secret to apple, and at most publicize a workaround (activate root user, set password) without reporting the details of the vulnerability.

EDIT: It does not appear to be limited to admin users. It appears to be related to disabled root accounts of older origin, such as through upgrades. I cannot reproduce on a fresh High Sierra install, but I reproduced on an upgraded install.
Paul Chapman is their CIO, give him a ping > https://www.linkedin.com/in/pauljchapman/
Which is a legitimate fear, and substantial effort should go into preventing such bugs, but any sufficiently determined person doesn't need to exploit a software bug to be able to kill others. ISIS appears to be quite effective at simply convincing its members to directly and voluntarily engage themselves in such acts.
Well, if this allows people to bridge the gap until the WebExtensions API in Firefox is comprehensive enough for their needs, then I'm all for it.
I'm a Linux desktop (and laptop!) user, and I agree (I haven't even used macOS in almost twenty years). Anyone remember the Debian OSPRNG issue?

These sorts of bugs can happen anywhere. We all need to bear that in mind.

One notable difference, though, is that macOS is proprietary software. Apple have sold their users a product and haven't respected their users' right to use, modify & distribute that product; their users have never had the ability to inspect the macOS source for this kind of problem. Thus, responsibility for this disaster rests solely on Apple's shoulders.
Alternatively, there's `sudo passwd`.
an unlocked computer, or:

* a computer with remote login enabled

* a computer with the main login screen set to "username and password" mode

* a computer with a guest account
High Sierra vulnerability discovered, here’s how to set root password for fix
Serious 0-day on Twitter. How exciting!
Most likely another from of bikeshedding; people don't have real input on the main matter, so they comment on circumstantial matters just so they can throw in their 2c
The Open Problem Garden, a collection of unsolved problems in mathematics
Important error in your instructions. They should set a very strong password and keep the root account enabled. Disabling the root account opens up the vulnerability again.
I think the headline is right. Any bitcoin owners best transfer to me whatever they have, just in case.

In all seriousness: The govt wants its taxes. We're talking HUNDREDS of billions now in coin value, not millions. Sure they are traceable, but at what cost? They can't pay $100K in fees to run blockchain audits to see if what you declared was correct or not...

USA has made virtually every bank in the world spend gazillions to report every account opened by a US person, Bitcoin is probably a walk in the park compared to that.
But everyone can fix this problem by setting a root password. So telling everyone is the right call. Otherwise people would be sitting vulnerable while Apple comes up with a patch.
root is disabled by default. The first try, somehow, enables it with no password. The second try will let you in.
Fair point, if that works with a guest account.

I was thinking along the lines of, if I have write access to your .bashrc (or a multitude of other config files that you as an unprivileged user have write access to, and can be used to trick you later into running code of my choosing), all bets are off.
The answer is not "this won't work in Safari", but "Safari is specific, that would be extra XX manhours, is it worth to you?"

It is only so much, that the clients are willing to invest extra into Safari, iPhones and iPads notwithstanding.
I thought SeaMonkey was still the entire suite (email client, HTML editor, etc). It seems to be further behind in keeping up with Firefox.
Using forks of unsupported Firefox versions/features (this, Pale Moon, etc.) is a good way to introduce vulnerabilities into your daily browsing.

Firefox ESR should be the addons stopgap of choice while they’re ported.
The loans don't actually come from the school- they are often government-sponsored, though those typically cap out at $12k a year or something. The rest you have to get through private loans, and the school has no way to forgive them- unless they want to write a check to my loan provider.
what is 2^300 ?
Forget Wal-Mart, tell that to Sears.
SeaMonkey is a different code base in the sense that the point of divergence was long, long ago. Waterfox on the other hand is very close of recent Firefox versions. SeaMonkey is descended from the Mozilla Suite, from which also Firefox descends, but SeaMonkey retains components that Firefox didn't like email, Composer, IRC chat etc.

BTW, I hope SeaMonkey gets a few more devs and love... from what I can see it's struggling badly. I hope to be wrong on this...
Distilling a Neural Network into a Soft Decision Tree
Let's wait until Apple release their patch so we know just how long they left everyone's machines vulnerable for. That will be a factor in determining whether this disclosure was irresponsible or not. It's been two and a half hours so far.
Reminds me of an exploit back in 10.7 where you could create a new admin privileged user from a non-admin account using some bash commands. Used that to add Xcode to my work computer at college so I could fool around with learning how to code when I was at work.
Late 90s/early 2000s. But my younger brother did the same for the past eight years.
The OP links a video from 2015 that implies that one of the advantages of making Stylo the first Servo component in Gecko is that the next phase in the pipeline, layout, will be able to benefit from having a well-defined interface in place. I'm curious about this as well!
This is actually something I thought it should be good to be service and it is great Amazon decided to make it. I didn't look into details, so hopefully it can be used without big issues. Really cool.
Ouch. This guy's going to kick himself pretty hard. The 15 minutes of infamy seems like a pretty bad tradeoff.
Sadly, Pale Moon is still not available on Mac. I wasn't aware of Basilisk, though! It appears that that one too is Windows/Linux only.
Remember that human feces ended up in orbit, although not from recent sources.
1) A lender can reduce (or freeze) your HELOC.
2) Pulling money out of your house during a downturn is dumb. You now have to pay interest on that, and in a few years or so, you're going to have a lump sum payment to pay off that loan.

If you just keep pulling money willy-nilly, you're very likely to lose that house.
People going on about responsible disclosure when this is such a gross violation of CUSSE: https://web.archive.org/web/20170712120031/http://www.cusse....
More grueling work, but likely left AT work. No bringing work home with you. Likely less job stress at home as well, though it might be replace by financial stress.
>In which case all bets are off anyways

How are all bets off if they don't have access to a root user? This isn't Windows we're talking about.
Who cares that Apple and Sony are H.265 only?

You are free to pay extra license fees for H.265 anyway. Your competition will not.
Your comment suggests that it is related to users with older, pre-High Sierra directory entries. That is, upgraded rather than freshly installed machines that leave older, pre-ShadowHashData intact. Is this correct?
>> Why do people downvote?

Because they can't handle the fact that you're right. RISC-V is coming for all of them. I like your phrasing too, it's accurate but I guess people think it's more pretentious. Only time will tell for sure.
But they'll frequently describe the race ("Arab", "Mediterranean", etc.) when talking about non-Germans.
Bloom launches a new platform to decentralize credit
Apparently you have to have the password field focused before you submit. Anything in the password field (including nothing) will be saved as the root password.
Or for those of us who find the new UI problematic.
This is true, and we provide that advice in the blog post we link to under the Embargo Strategy section:

"Can journalists break embargoes? Yes, some journalists notoriously will not honor embargoes. There’s an easy solution though — only include information in the pitch email that you would be ok with a journalist publishing. Once they agree to the embargo, you can share the rest of the story."

However, we've worked on hundreds of campaigns under embargo, and a journalist has never broken one. With early-stage startups, you can't really afford to be cagey with your news, as response rate will be so low anyway. You have to provide the lede upfront to get journalists interested in the first place.
Should I leave my Mac unattended until this is resolved?
Situs Judi Qiu Qiu Bank Nasional – Situs Qiu Qiu – Pokerqq81
I wonder what is going on with software quality and testing at Apple. It feels like recently there have been quite a few issues like this (the FileVault password bug, numerous issues with iOS 11, the issue that totally broke iOS Safari a couple of years ago) which should have been fairly easily caught, especially given the limited range of devices their software runs on.

I know testing is hard, but a company with Apple’s resources shouldn’t be making slip ups like this. It suggests some real issues such as lack of unit/automated tests and/or sufficient release testing, which pretty urgently need addressing.

Anyone got any inside scoop?
Pale Moon reportedly backports security patches.
What a stupid point of view, because the entire point of net neutrality (title 2 or otherwise) is to ensure that it's possible for twitter et al to be overthrown by an upstart who gets a level playing field wrt Internet traffic.

If Pai gets his way, ISPs will be in a great position to cement Twitter and Facebook's monopoly with preferential treatment and free subsidized internet plans.

I guess this shows the true plan: make the big ISPs happy, and solve the problem of "net neutrality" instead by adding more government regulation into the picture to regulate the market of internet applications. Truly the worst of both worlds.
There’s no need to do this yourself to verify it. Doing so creates a “root” account that others may be able to take advantage of if you don’t disable it.

That should be much higher up in the article.
I guess not. I recall reading somewhere that the Linux kernel doesn't even have automated tests. (edit: found the link: https://stackoverflow.com/a/3177643/96855)
Too late to edit my other reply.

But I want to add a correction here. If I understand correctly, it didn't come to the judge through an independent case. It came to the judge because the judge referred the situation (Uber hiring Levandowski after Levandowski took documents from Waymo) to federal prosecutors. Those federal prosecutors got back to the judge with stuff that Uber should have turned over as part of discovery, but didn't. The judge is not amused.
Its not just Apple though. Microsoft had the similar problems in the past. Edge did not support silverlight causing people to move to other browser. It was strange to see Microsoft's own software not supported by Microsoft.
There's a sense it which it isn't your responsibility to figure that out. If they never check, you avoid annoyance. If they do check (A/B test, eyeballing it, whatever), they'll see. If they're unwilling to turn it off no matter what then they're kind of terrible, and probably should lose lots of traffic.
"Enterprise adoption" is still years off, "job opportunity" is just starting to come into its own. But the real reason I'd call Elixir a better place to be right now is the community. The Erlang community is not growing. Elixir's community is.
That says the symbols themselves can't be copyrighted, so that for instance you can't go after someone for photographing or painting a stop sign. It does not say that photographs of familiar symbols and designs can't be copyrighted.
Samsung Develops Battery Material with 5x Faster Charging Speed
FWIW, I've had much better luck with vim-vixen than I did with vim-fx. Obviously ymmv