skysight-inc/HackerNews huggingface dataset:
A better analogy would be "if the lending bank left the door to your new house open..."

Other than buy an Apple product, the users did nothing intentional to undermine security.

Since this is a subjective argument, based more on historical instances of "responsible disclosure" and not law, I'm gonna lean in this case of it being Apple that failed

They built the entire "walled garden" without getting outside help. They want the control, they have billions of dollars, can hire whatever talent...

Failed to spot a password-less root login issue.

People need to know today to be even more cautious about using Apple gear in public places or around plain ol' tech jerks that like to fuck with people for a gag.

Society has no legal or moral obligation to make sure Apple stays in business.
It's a conflation of two separate issues.

If you have open network access then you have access to alternative providers that will host people that may be banned or restricted on Twitter (see GNU Social and Mastodon).

If you have ISPs regulating what you can and cannot access then you don't even have that choice - you get the worst of both worlds - Twitter acts as a gatekeeper and your ISP acts as a gatekeeper on top of that.
Title should be changed to 'macOS'

I initially saw this thinking it didn't affect Sierra or High Sierra.
I agree that we need more responsible disclosure. But as https://www.eff.org/deeplinks/2017/10/drms-dead-canary-how-w... explains, blame the DMCA.

Somebody in Turkey has no expectation that they will be treated with respect. It's much more likely they will be attacked as in "shoot the messenger." (So, please don't attack the person who brought this to our attention.)

I think they made a reasonable decision, due to the critical nature of this bug, and tweeted about it.
Playing cards marked with radioactive iodine
When I was a kid, in the 80s, our public schools were half-day kindergarten as well (Washington).
It also works on 10.13 (17A365)
You can keep using it.
Sure – not trying would be obscenely irresponsible. But:

1. I don’t trust them to do that right

2. You’re later to get the same patches

3. You can’t backport patches for removed features
Hi, co-founder of Graphcool here. It's very exciting to see AWS adopting GraphQL as a part of their offering. GraphQL in combination with serverless functions is a great fit to build applications quickly and shines in the use case described by AppSync.

P.S. We'll soon release a few example of how to use AppSync together with Graphcool (which works really well together!)
I told you, its an exciting time to be a parent.
A bit confusing that there's blue, underlined text that look a lot like links.

Perhaps this was posted too early and should actually link to more in-depth docs?
If you have remote login enabled does root/no password not work already because of the bug? It apparently does from the login screen if you have username/password mode on, so I wouldn't be surprised if it worked over remote login by default.
> Maintaining an infrastructure that can handle streaming at the scale of Netflix costs money no pirate bay will ever be able to afford.

Popcorn Time? The streaming bandwidth is handled by the very people watching the video.
Well, I'm certainly happy to admit my details are incorrect, but I think my broad point still stands—they look longer term than the typical commercial offering.
So someone stumbles upon a lost cache of chemical weapons. Rather than reporting to the authorities, they post its location on Twitter. That's called just using your brain.
I tried it anyway and it does not work! I'm running version 10.13.1
Over an eighth, less than a quarter, and it had been months since my previous mushroom (or acid, for that matter) trip.
To be clear, the funding here is via a Google Faculty Research Award, which is a one-time payment largely focused on supporting one grad student for one year.

https://research.google.com/research-outreach.html#/research...

Google is typically fairly hands off with these awards and we have not, at anytime, felt pressure to pursue a certain direction because of Google funding (though of course, there may be implicit biases that we are unaware of). Most of our funding is via the NSF.

Project Sidewalk is quite dependent on Google Streetview and its API. I don't believe there is a good alternative out there currently (Mapillary is a possibility; Cyclomedia is another but they work via private contracts, which would likely be prohibitively expensive for us). So, if Google decides to end Streetview or significantly change its API, then it will dramatically impact Project Sidewalk's viability. Our hope is that Streetview only becomes more robust and updated more frequently, which will make it an even more valuable "urban science" dataset.
*macOS High Sierra
Ah, even that's a phase. Wait 'til they get a girlfriend/boyfriend and a taste of freedom. Suddenly it's all bus passes and coffee shops and wandering around downtown in every weather. Can't get them home.

(But when they are home, yeah, it's text text text.)
Interesting so the data is actually stored in a datasource like DynamoDB and this is a managed GraphQL service that you can use to handle auth, mapping, subscriptions etc
I’m a Tech Person with a Product. How Do You Find a Business Developer?
I think you are making a joke but it is the latter case. He see you using it so he knows it must be important! and his primary tool for figuring out the world is his mouth!
I've analyzed a lot of startups data over time and at least over the past ten years I've found that determination correlates higher to success than intelligence. Most startups are not rocket science.
Sure. My point is just that you can't bring up the total number of lines of code here, because most of those lines aren't in any way related to any safety-critical system. If you want to talk about how much code there is which puts you at risk, you need to look at that particular subset of code.
If you had a swarm of 1000 small robots, each of which has minimal power and sensors, what would you do with it?

Do you need to ask? Look around, although many uses positive and negative would be found the primary two would be: espionage and “warfare” in that order.
He makes a good point that a small number of gatekeepers for what is accessible online isn't good but are we really at the point of being openly racist and sexist? It's not like it would suddenly be okay if the names were Aliyah, Marcus, Cho, and Katie.
The title is wrong: it affects High Sierra, not Sierra. Edit: they've fixed the title
Heads up: The link about Amazon & VMware should be https://www.iguazio.com/vmware-on-aws-a-scorecard-for-winner...
lots of users + all-at-once release = lots of crying.

but that also means everyone has the same setup, same problems, and stuff gets fixed quickly.

that's my experience anyway. it'd be fun if someone tried a side-by-side daily-experience report of say ubuntu, windows, and macOS. our own personal perspectives are always colored by time and chance.
Definitely. We've been in contact with them as well, and we hope something comes of it. As I mentioned above, WheelMap focuses on POIs but not how to get to those POIs, so our work is complementary.
I was similarly curious; I think your guess about "peeking" is reasonable.

Assuming an unsophisticated house that doesn't switch decks, I was also thinking that you could even have a tiny bit of isotope-mixed-substance on one finger and "mark" cards that come into your hand on the back in some magnitude.

If the detector is near your wrist/in your sleeve you might be able to get some approximate magnitudes of various hands/face down cards in your proximity; or as you say, if the dealer was involved/the one doing the cheat it would be even easier since they could "listen" to the cards as they dealt them. You might not even need it to be directional in this case.
Amazon is amazing at creating scaleable and reliable services, but their UX and the way they announce new products is awful.

There's room for startups to wrap these services into something more usable. There are already good examples: netlify, graph.cool, dashbird and others.
Now you have me confused, is it just High Sierra or Sierra as well?
Seems promising. I'd be interested to know how this compares to something like RethinkDB for "realtime" (awful word we've settled on to describe changefeeds and such) apps.
Hi obilgic, thanks a lot for the shout out!

This is a super exciting announcement from the side of AWS which is really well aligned with some of our upcoming product changes. Expect some news in the next couple of weeks!
That depends on the manufacturer. There's no reason such a thing has to be there.

A lot of people are hoping that someone will put in the work to bring the architecture up to speeds competitive with i7 and mass-manufacture it, despite being legally cloneable.
I agree.

https://www.eff.org/deeplinks/2017/10/drms-dead-canary-how-w...

Blame the DMCA. This guy is in Turkey - does GP really think he can expect fair treatment and equal compensation as a "western world" security researcher?
On most systems, root without password isn't available remotely. Is this not true on OSX?
It's an issue with proprietary software in general, not just Windows. If they do that with Windows, I wouldn't trust them with a pre-installed version of Linux either: who knows what they would hide in a proprietary device driver.
glad linux is working for ya. "think different" is mostly just a marketing slogan, but it's also not inconsistent to think that people want to "think different" by working on their shit, not customizing their desktop. :-)
You're coming at this from a position of knowledge and assuming everyone else knows as much as you do, or should be able to figure it out in short order. That's not how it works. It's really hard to see how other people might think in situations like this.
Simple Ways to Grow an Interactive Audience – Basic Blogging Strategy
Benchmark: Cost of AWS vs. GCE vs. IBM vs. Hetzner for Machine Learning
whataboutism.

we need more competition between ISPs _and_ more ISPs to select from (I have 1 with speeds that would allow me to successfully work remotely on Long Island NY).

I cannot see any other way for the consumer to win in any situation.

in regards to twitter, I agree they all have issues including recently the censorship in Romania [0] -- that is a _separate_ issue that also needs to be dealt with.

[0] https://news.ycombinator.com/item?id=15790687

edit - added links typos
Oh my goodness. I have a High Sierra MBP. I am scared right now BADLY
> Again we don't know if AV1 is royalty free because it hasn't been tested yet. VP8 infringed on a number of MPEG-LA patents and would've required a license. VP9 could likely be the same.

On the contrary, we know that nobody has tried to set up a patent pool for VP9 or otherwise ask for royalties. On the other hand, new patent pools for HEVC keep popping up. You could pay one and then be asked to pay another. https://blog.streamingmedia.com/2017/05/velos-media-hevc-pat...
"It only works after getting physical access once" - quote form somewhere else in the thread
It does not work for me using Sierra.
Would disagree. HN is critical in the sense that people actually debate a significant amount of the time instead of replying with memes. Calling spades what they are isn't, in my opinion, equivalent to being needlessly critical.

As for bullying, I think we can all agree that vote-brigading, doxxing, trolling, and racist speech are far more prevalent on reddit than HN. /r/fatpeoplehate, /r/the_donald, /r/roastme, /r/murderedbywords being some good examples, not to mention incels and redpillers.
Sure, now look at his Twitter account. He looks pretty plugged into the software community.

Agile Software Craftsman, iyzicoder @ http://www.iyzico.com , Founder of Software Craftsmanship Turkey @scturkey, The community guy http://bit.ly/lemiorhan
Also, it's reasonable for someone to think that making a public stink about it is in the best interest of all the people then that can immediately patch it themselves instead of having to wait for Apple to push a patch and then for everyone to download that patch.

I'm not convinced private disclosure is without its downsides nor a panacea.
For a while I was thinking of the idea of Gecko for legacy XUL support and Servo being WebExtensions only.
Well, I'm not even necessarily trying to soap box here about open source or free software per se—I do think commercial/proprietary research has value to society as a whole, albeit less value. For instance, take Big Table—enormously influential and, I think, beneficial to society in spite of being largely closed off to the public. However, rust is way better for everyone, and I find it shocking it came from such a relatively small organization.
I can confirm that, too. Took 2 attempts.
Public transit is overcrowded in many places. So the less people that use it the better, as it means that it won't be overcrowded and have to deal with the issues that overuse creates.

It is not about 'nobody' using it. It is about less people, than the already too much people who are using it.
Show HN: Cut Web Bloat with Google WebLight
The majority of programming languages used across the industry have had commercially oriented organisations behind them, including all the C family of programming languages.
I find one of the most effective ways to do more with less is to ignore work after work, enjoy my life and show up the next day well rested and not stressed.

If it's important you'll get a call. When I do work at a place that prides itself on people being available around the clock, i'll delay send / reply to something right before bed and then plugging in my phone in another room.

Gives the appearance of working the most hours, interrupts other people / ruins their sleep, doesn't really affect my life in any material way.
I disagree. Being unaware of the flaw doesn't make you more secure.
If you have `osquery` deployed to your fleet you can detect compromise with this query:

SELECT * FROM plist WHERE path = "/private/var/db/dslocal/nodes/Default/users/root.plist" AND key = "passwd" AND length(value) > 1;
The next Servo component is webrender and I'm not certain on if it has been flagged to on for developer edition but that would certainly affect speed.
Full disclosure is also a form of responsible disclosure.
wifi on macbooks is notoriously awful, and has been for the last 10 years or so.
I'm not sure that there will be many XUL extensions left maintained after a while -- since no major browser supports them and the fact that WebExtensions is a much easier framework for development. As a result, I don't see much of a future in Firefox pre-Quantum forks.
Missed my point: First it is only fair. You cause problem for our Google and Facebook expect the same. That's fairness and economic patriotism. Not to mention that Google and Facebook "own" or can own US Congress and Senate. Hearings will start in days.

I believe that in authoritarian regimes you have ZERO choice or recourse. See Russia or Al-Waleed in Saudi Arabia. They will simply shut you down, break you in a gazillion pieces.

In USA you have courts at least. Have you noticed that Google is pushing encryption all over the web to make NSA's job harder or impossible? Let Alibaba or TenCent help thwarting FSB or China's security services
Movavi Video Editor – WELY TECH REVIEW
Bitcoin price rose to $10,000 in November while mining difficulty decreased?
> we've worked on hundreds of campaigns under embargo, and a journalist has never broken one

My point is that they are not breaking the embargo by publishing the contents of your initial email.

Whatever you send in the initial email is decidedly not embargoed. Totally get that the risk can be worth it, but you're implying in this post that the information is actually under embargo when sent before explicit agreement.

Journalists take you more seriously when they see you know how works: https://twitter.com/ceodonovan/status/773966062974926848
According to www.merriam-webster.com hip means "having or showing awareness of or involvement in the newest developments or styles". Or "very fashionable". It seems to me too, the word is more associated with dynamic movement than other words.

If you look at the pictures, in all of them the black people have either a more unique hair style or more dynamically composed picture framing and pose.

I would like to see the results when controlling for such factors as hairstyle, pose, and framing.

Interesting little research project though. Here's the link to it: http://jasoncomely.com/hip/NaturallyHip-Psy-AS1.pdf
And Heroku!
If they have access to the account that is being used normally, they can modify the (user-accessible) settings to trick the user into running malicious code and giving them access (or causing trouble even without access to the root account).
Totally agree! My point being: saying "I am proud of my country" will come off as being black and white to some ears.
These bugs are getting ridiculous. With Apple's budget, finding such bugs in a security architecture review or just in QA should be as easy as 1+2+3.
How long is a piece of string?

It depends entirely on features and performance. Like Intel and arm chips have a 10x range of cost.
It feels like an older version of "sheeple".

In terms of modern Stoic writing, I find Ryan Holiday's "The Ego is The Enemy" and "The Obstacle is the Way" (as well as his "Daily Stoic", although that's more of a daily devotional) to be very enjoyable and help to reframe the often hard-to-read writings of Aurelius, Seneca and Epictetus into actionable advice.
It's pretty much standard these days for any non-VM language to target LLVM.
If you look at CSaid's twitter stream, it looks a lot better for Uber now and Waymo looks like it might be in the judge's crosshairs.
Step three: Right click taskbar, 'Taskbar buttons:' -> 'Never combine'. Result: both app and document tabs. :-)
Agreed with the proviso that it's not just "with" but "caring for". You can be with them and not engaging in any way. You can be caring for them without being directly engaged with them (eg supervising a playpark visit).
I'm using 10.13.1 and it did work for me. You have to first fail a login in one of these dialogs (did it with my current user and no password) before doing root with no password.
You can jail executives for the bad behavior of a corporation. (I know of one case where executives of a medical device corporation were trying to ignore the FDA, and the US Marshalls marched them out the door in handcuffs. Not even the door of a courtroom - they arrested them at their office.)
just buy a new tv. what, do you hate consumerism? do you hate america?
Interpreting Deep Neural Networks with SVCCA
San Francisco ballot measure on affordable housing would test voters
HEVC (H.265) is only used in germany for DVB-T2 (all other countries do use H.264). And DVB-T2 is not in widely use (even DVB-T was a failed product). I guess the only users of DVB-T2 are campers.

(edit: Currently DVB-T2 is only free for open senders (ARD, ZDF, senders which are paid by the "Rundfunkbeitrag", the rest costs money. it's not in wide use and probably never will Astra Sat / Eutelsat or cable (DVB-S2/DVB-C which all only use H.264) is probably the way which most people go, after the DVB-T debacle. And heck even than H.264/H.265 is implemented by DVB-T2 vendors but DVB-T2 does not need H.264/H.265 it can be used with AV1 aswell.)
Do you honestly believe Apple will pay out the same to someone located in Turkey?
Missed that part in the text, thanks.

Yikes!
I just shut off the wifi and turn off the data on their phones
This reminds me of:
https://news.slashdot.org/comments.pl?sid=8898847&cid=517351...
I find it hilarious that while they took the time to give FF57 a new "touch" UI, the zoom gesture is still only enlarge the font size.
So his argument is, "Edge providers censor content in a biased manner, and that's bad. Therefore broadband providers should be allowed to censor content." It's a non sequitur. If the ability of large edge providers to selectively censor content is a problem, it stands to reason that allowing broadband providers the same privilege would be an even bigger problem. And that's completely ignoring the fact that he's making his usual false claim of equivalence between edge providers and broadband providers.
The point is you don't know which of the 1000 is going to be your pay day.
> You'd have to add up the marginal probabilities of all the other scenarios, to compare with just the Earth scenario.

There aren't even close to billions of other planets that could have been candidates for sending a life-bearing asteroid to Earth. Some of the restrictions are:

1. A planet capable of having developed life.

2. A planet close enough for an asteroid from it (I have trouble typing that because it's such an unlikely scenario) to have reached Earth around the time that life on Earth began. That was ~4 billion years ago, which seems like a lot, but consider that if the recently spotted asteroid 1I/2017 U1 had come direct to us from Proxima Centauri, the closest star, it would have taken at least 48,000 years to get here. That puts a limit on candidate sources of less than 100 times the distance to Proxima, and limits the number of star systems to ~2 million.

Even if you multiply the probabilities in question by a factor of 1e6 to 1e7, it's not going to change the conclusion.
I've been a developer for a long time. I understand bugs happen, even bugs with terrible consequences. A lot of bugs seem understandable, like I can see the chain of ifs/thens required to end up at some hilarious broken state.

But I'm breaking my brain trying to figure out how in the hell a login attempt for "root" will enable it if it's disabled. Why is this is a possibility, to just enable root, no questions asked?
I wouldn't bash the guy. Someone already let him know about his technical faux pas in a professional manner on his twitter.

My guess is he found this vulnerability on accident, freaked out, and tweeted about it. Probably has limited infosec experience.
Am I the only one who feels this is just another ism being packaged in a trend-friendly form? IOW, stop, think, don't make an ideology an inseparable part of your self-view. Ironically, that seems like an idea the stoics might have endorsed.
Isn't the best practice full disclosure? It seems like it was followed well.
macOS and iOS updates at Apple are now inextricably tied to new iPhone releases. There is a strict yearly deadline that the teams sprint toward, a timeline imposed by marketing rather than readiness. This affects prioritization of which features are pursued, where they lie in the stack, and how polished they get.

Insufficient testing at today's Apple is not limited to software. They bragged about their extensive input testing lab [0] when the new line of Magic accessories was released, but the Magic Keyboard with Numeric Keypad launched last summer had all of its inventory pulled from the channel last month because users discovered that the model was so thin that its midsection bowed over time.

[0]: https://medium.com/backchannel/what-i-saw-inside-apple-s-top...
I asked this in the other thread, but... does anyone know how big of a bounty the guy missed by not disclosing this responsibly?

I'm guessing it probably would've been a fairly big chunk of change.
They should be, though. I worked a university tech support line for a few years in college and we had a a whole set of redirections and escalations built up.

It's best that people only call you for the right things, but once they are already on the line your only real choices are to help them get to the right person or tell them to fuck off. To the extent the company cares either about service or their brand, they'll pick the former.
Coders should be afraid of what happened to the journalism industry