skysight-inc/HackerNews huggingface dataset:
it worked for me on 6th try or so. First few times, the prompt was returning to my user name, but then another failed attempt left it at 'root', and the next attempt succeeded
Someone tell the Linux and UNIX users of the world that having a root account with a password is a "hack."
> They are interested in the fact that it is both decentralized and immutable

So like https://ipfs.io/ or various other append-only logs? Or the certificate transparency project?

The blockchain is the least efficient way to create a distributed append-only log if there are a fixed number of trusted actors publishing to it.

Banks can far more easily publish append-only logs of transactions without the extra noise of "mining" and comparing longest chains based on proof-of-work.
iAmroot to respect the brand policy.
Bitcoin is unlike a currency in that it is difficult to have a transaction, today, using bitcoin. That will hopefully change, but that is how things are today.
Do "responsbile disclosure" rules apply differently to Apple?

If so, why? How do you identify companies like Apple that get one set of rules to other companies?
Yup. Can confirm. I installed it fresh on a VM from the downloaded installer and it is affected.
AFAIK usually sudo doesn't let you enter an empty string as a password, even when the actual password is empty. So that is what you might be experiencing.
He has a point since I could always go down to the reserve and trade my dollars in for cold hard gold. Oh wait...
> The reason banks and big financial companies are interested in it is not for its speculative value. They are interested in the fact that it is both decentralized and immutable.

None of the blockchain projects or proposals being worked on by enterprise financial institutions are decentralized. A decentralized ledger is conceptually antithetical to a small group of organizations which trust each other and want to retain control over the shared ledger.

It can be immutable, but for that matter I don't really think it's immutable in the same sense as a decentralized, permissionless ledger is. The organizations in charge of the blockchain can create a hard fork, which everyone participating with the organizations will have to abide by, because the blockchain is not decentralized.

In fact, what we actually have is a consortium of companies deploying distributed database structures and calling them blockchains. I'm sure there is a legitimately new innovation that can emerge from this sort of blockchain, but it won't be decentralization or immutability.
Homo Deus: A Brief History of Tomorrow
When the decision was made to make a browser-only version of the Mozilla suite, a separate front-end was built on Gecko eventually called Firefox. The legacy suite was renamed SeaMonkey, and it still uses the same repository. The trunk version of SeaMonkey uses the trunk version of Gecko, and it doesn't fork or modify the stock Gecko in anyway.
> Making it difficult to access something is always worse than not having anything to access.

Not a choice now. If people have physical access to Macs at the moment then it seems to me there are two options right now: either 1) you have changed the root password, hopefully to a strong password or 2) they'll be able to login as root.

Right now you can expect the participants in this thread to be a little smarter than the average computer user.
Is this a joke? If so its really funny. If not...you definitely are missing the point
The problem is that this is not a zero day in new technology. They made a jr sysadmin mistake. As a company who wants a reputation for good security, that is not acceptable.
It seems as though buying a new apple product or upgrading one to new software implicitly signs you up to be a beta tester. It's pretty surprising from the world's most valuable company, no?
Nah. Banks and big financial companies interested in the blockchain will spin up their own version without tying it to the unstable mess of bitcoin. e.g. https://ripple.com/

And people do by treasury bonds for their rate of return, when the investment must be as riskless as possible.
> Neither is your password showing up in a password hint field (or anywhere for that matter... why is it even stored unhashed?).

It's not stored unhashed. And the password hint field never showed the password, it always showed the password hint.

The bug was Disk Utility's UI was accidentally using the password field instead of the password hint field when passing the data to the underlying API.

> Neither is logging in with a blank password enabling a disabled root user.

Stupid and awful bug, sure, but I actually can understand it. Something that's worked fine for years breaks because of some change to some underlying system, and there weren't any existing tests to see what happens if you try and log in as root (root has been disabled by default for something like 15 years, so it doesn't surprise me that people don't test trying to log in with it).

But apple.com not rendering right in Safari? That doesn't make sense, you know damn well apple.com is basically designed to be viewed in Safari and everybody that works on it is going to be using Safari with it.

And Safari not being able to load HTTPS sites makes even less sense. That literally breaks most of the web. This has to be an issue with the local computer.
Vanguard never owned subprime CDO paper in its money market funds.
Fibers? I thought they were implemented and that was what React 16 was all about.
Thank you for being clear on the front page about the goals of the project, and for providing a detailed overview as well.

However this project also badly needs a "hello world" example. Right now there is no way to get started except to start reading the docs front-to-back, which is more than I can tackle during a lunch break.

That said, I really like the idea of a language specifically for encoding automata and I'm excited to try it out.
Apparently that is enough to sustain it. Many people have successfully liquidated their position and found new buyers.
You can track it here. Still plenty of work to do but we are making progress.

https://github.com/facebook/react/issues/8830

https://github.com/facebook/react/issues/11566
There are two ways a new GC might be helpful. It might reduce the length of any individual pause (though normally at the expense of total overall pauses) and it might reduce total memory usage by compacting the heap and being a precise rather than a conservative collector.

The current emacs GC can introduce long pauses, so I’d be happy to see something which improved Thant, and I have seen annoying increased memory usage in long emacs processes so experiments in this area would be welcome.
Well, 1 is your opinion so it's hard to change that. 2 is obvious and not really a problem. So the only thing you had was 3.

And no, I mean demonstrably wrong. But you are right that all the useless attack surfaces that Firefox has (ie, WebGl, Websockets, Pocket, etc) aren't in Pale Moon. Luckily for PM it doesn't need to do as well or better than Firefox because it simply doesn't have all the excess "features".
I've been quite impressed with the 7260AC chipset in the T440 and newer. Places where I used to get 30Mbps down, it'll hold well above 100Mbps, with the same exact 1st gen AC Access Point.

That being said, its worth it to swap a T460 trackpad in to get a decent trackpad. IIRC they're sub-$15.
> However, as multiple household members increasingly consume video streaming services music
streaming, and online games, the adequate broadband speed bar has been raised. To understand
just how slow 3 Mbps is, it takes about 2.25 hours to download a 6 gigabyte movie. The same
movie would only take 16 minutes to download at 25 Mbps

The FCC later increased their definition: https://www.theverge.com/2015/1/29/7932653/fcc-changed-defin...

We both know 3 Mbps isn't enough these days, and it hasn't been enough for many years.

https://arstechnica.com/information-technology/2014/09/comca...

The previous PDF I linked, from their FCC filing, discusses the reasons why they don't compete with each other.

Sorry, I'm still stuck at work.
Bogle advocates buying broad stock and bond indexes[1], so yes, he's down on gold too. But that doesn't stop Vanguard from offering a precious metals and mining fund [2] or actively managed funds[3].

[1] https://www.npr.org/2015/10/17/436993646/three-investment-gu...

[2] https://personal.vanguard.com/us/funds/snapshot?FundIntExt=I...

[3] https://investor.vanguard.com/mutual-funds/actively-managed
From React 16 blog post (https://reactjs.org/blog/2017/09/26/react-v16.0.html):

>We think async rendering is a big deal, and represents the future of React. To make migration to v16.0 as smooth as possible, we’re not enabling any async features yet, but we’re excited to start rolling them out in the coming months. Stay tuned!

The rewrite was about adding the foundation for making this even possible. But there's still work to do before we can enable async rendering by default.
That's a whole week where they can get owned by any kid with physical access to the machine. In some settings (schools, libraries) this might be a huge issue.
> Anyone with enough capacity can basically seize control of the currency, so it's anything but stable.

The amount of resources required to execute this attack is moving higher at a rapid pace. Also, a 51% attack can gum up new transactions and potentially double spend, at least until people realize the attack is happening and stop signing new transactions. It can't rewrite blocks from the distant past to send everyone's coins to the attacker's address.
> On what basis do you "guarantee" this?

I think on the (probably intentionally snarky) basis of "just making up statements":

> Since we're just making up statements, I guarantee that Apple would never voluntarily disclose this issue if it was reported privately.
Do you have any good history on this you can link to? Sounds very interesting.
I use Todoist. Just about every task has either the Next_Action label, or Waiting, as well as the location.

Then I can see all of my next action tasks I can do at my current location.
shapeshift publishes all trades
Nope. For one, gold has intrinsic value and can actually be used as a manufacturing input.
The Bitcoin bet is that traditional financial markets have it wrong, or don't serve the market Bitcoin serves. You judge how likely that is to be true.
Ask HN: How to monetize free content?
What are ways besides ads and affiliate links to monetize free educational content, targeted at entrepreneurs?
You do ask how people ran their drug-and-weapons enterprises before bitcoin. You'd guess it was through shady lawyers, corrupt banks, tax oases and webs of mailbox holding companies all the way down. That's proven working. But with bitcoin you are stuck with the dozen shady exchanges. Any normal criminal would think it's too risky.
Yes because he believes you should invest in things which inherently generate value.

Note that gold has inherent value in its use for conductivity or jewelry, but it doesn't create any more, which is the same at bitcoin.

In other words, I think he would argue that there's nothing "wrong" with buying gold, but you buy gold as speculation and not as an investment.
Apparently, High Sierra has a 'feature' that updates hashes to a new format on login, and consequently publishes a hash where there was none before. Which pretty much disables the 'no hash, no login' policies. Ooops. Donno if that's unique to the GUI, or if a simple 'sudo su -' would also trigger, as I don't own a mac.
The Evolution OF Security At Riot Games
You would do that.. but you don’t consider what you should do.. surely responsible disclosure is the smarter strategy?
> That doesn't mean anything. It just means that whatever is messed up affects Safari. It's not like the computer recognizes "oh those 3 apps are all web browsers, therefore if I'm going to screw one of them up, I have to screw them all up". Your claim would carry more weight if you were listing multiple browsers that all use the same system-provided WebKit.framework, but Firefox and Chrome are completely separate browsing engines.

That fact that everything besides Safari works certainly means something and the fact that they have different rendering engines is irrelevant. What is relevant is whether a site renders in a browser or not.

> Well I don't know what to tell you, except to point out that there's, what, hundreds of thousands of registered Apple developers now? who've all had to go through that form, and there's only a handful of people on that thread, so it's far more likely to be a local issue.

Well that's just one example of dozens of people having that problem. Also I have successfully filled out that form my self in the past, as I am a registered apple developer. But just because large amounts of people can use the form successfully does not mean that there isn't a bug affecting other user's like my friend.
> There is nothing to support bitcoin except the hope that you will sell it to someone for more than you paid for it.

Not everyone agrees with that statement. For example, see:

https://news.ycombinator.com/item?id=15797380

https://news.ycombinator.com/item?id=15796880
> I will happily invest in Bitcoin when its history as a store of value and a medium of exchange is measured in millennia.

So is USD out for you too, then? It's not even 300 years old yet. If you mean fiat currency in general, that's also out, as we haven't had that for multiple millennia yet either.
I think there is a sense of “if I pay, it probably has a value so said company can charge a customer, and it is likely said company will not to fail so soon.” Not that this is always true, but with a reasonable trial and active customer support team, I think a starter plan is never a bad idea at all. Making a paid plan also means the company has to work double harder now to deliver a better product and a better customer experience, unlike IMO a free tool has the “we will get there eventually, let’s test with free users first.”
I assume he means that you should always set a password for "root". Though most users don't even knows it exists.. hence it should have been taken care of by apple.
Thank you! This is exactly what I was looking for and it seems all search engines have failed me!
"Eh, Slim Johnson, whys you always flapping yer arms around whens we playin poker?"

"Shoulder exercises, Bill. Shoulder exercises."
I confirm, disabling from shell does seem to prevent further logins
If there was a vulnerability that allowed anyone to open your car and drive off with it, you wouldn't care if he was the first to find it or not. You'd only care about it getting fixed before anyone else knows about it.

I'm not sure what length grace period is appropriate, though.
H.265 support is a patchwork in hardware though, look at all the recent Allwinner chips, only 8 bit H.265 playback is supported, despite quite a few H.265 files using 10 bit colors.

Worse yet, most Chromecasts and TVs don't support anything newer than H.264. It will be years before H.265 or any new competitor sees hardware support in most homes.
That works in ReasonML :)
Bitcoin has the best security model. In 10 years does a single massive ledger make more sense than transactions at the edges? The value proposition of Bitcoin has always been transaction scalability by elimination of charge backs. With a fundamentally irreversible ledger as a base layer, networks and services will develop around it that provide whatever combination of speed, fees, and liquidity you're looking for.
I think you’re overestimating how much the general public cares about Uber. The scandals haven’t negatively affected Uber financials, I doubt they will have an impact on the trial.
That seems the only probable cause I've come across so far. It doesn't seem to be a backdoor because it would be more of a back-spillway-gate.
"An American Sickness"
It's an analogy (and it's not mine, mind you; I simply tried to make it more accurate)–don't take it too literally. Hacking is a thing that exists. By reporting this publicly it's become a lot easier to hack people.
If you suffix that sentence with "...so the IRS will have trouble taking me to court for money-laundering", the lawyer wouldn't even have to "pervert" it. Privacy is not suspicious. Privacy with the explicit, stated intent of concealing illegal behavior is perfectly reasonably suspicious. Similarly - I would not bat an eye at the average car purchase, but I would think hard if someone asked me to recommend a car that would not be damaged if it hit someone. I would not give a friend access to my computer if they said they were going to use it to send spam email. Etc.

This isn't about the privacy tech. This is about Uber being evil, knowing that they are doing evil, and trying to hide their evil from the courts. The fact that they worked at a high level to hide their evil destroys any pretense that it was accidental or unintentional.
I did not notice any change since DRM was implemented for movies, piracy was illegal before and piracy is not much harder with DRMed videos, you can watch Game of Thrones immediately as it is released. Maybe you think is harder now but is easy to pirate and easy to find the pirated content with google, then click play and done.
If you have time I recommend reading gog.com page on wikipedia and also find the interviews with CD Project Red devs about DRM.
Hey! Co-Founder of GraphCMS here. Super excited to see that more and more tech giants see the huge value in GraphQL. This is a great day for the community.
I am also a huge fan of the Graphcool service and I definitely see great integration potential here. Looking forward to the next weeks! Well done, AppSync team!
The problem is that even though there's Play Store and App Store badges, to me, my brain subconsciously parses "this app is available for you" based on the existence of the home button in the mockup.

I saw the home button, I assumed iOS only.
I don't know any users that are ever happy with any chatbot. The only exceptions I can think of are Apple Siri and Amazon Alexa, that's only because they respond to your voice and save you the trouble of typing or clicking, not because they have any intrinsic value as chatbots.
I can see how this can be seen as bad. Just, I don't think he is familiar with underlying technology and that is why he can't see how this will work. In a way this is ageism and I accept your criticism. But I still don't think he is right and understand this correctly.
You've been breaking the guidelines by posting unsubstantive and/or uncivil comments. Could you please stop?

https://news.ycombinator.com/newsguidelines.html
Having a root account is a password isn't a hack, it's making one as a workaround for this bug that is.
Or they have real circumstantial comments to make.. it doesn’t have to be that they just want to talk
> Is there something you don't like about them?

You mean, in addition to bad QA and complete disregard for their users' security? And being the richest and most profitable company ever, cutting corners and evading taxes?

Their response on Twitter was amazing: "PM us so we can discuss this privately", not "thank you, we're looking into it NOW".
Errson?
I love to see these small improvements added to React.

Everything is not perfect though, some issues have been here for a looong time. At the moment, my biggest problem is the non-support of passive events [0]. And today, some browsers are starting to make some events passive by default (`touchmove` on Chrome for example), it is quietly starting to become a serious problem for developers to get things working fine cross-browser without anti-patterns.

[0] https://github.com/facebook/react/issues/6436
I don't see any advantage of Emacs going from the current mark-sweep collector to a copying collector. I don't notice GC pauses using Emacs, and even after being up for weeks, I don't notice it bloating from memory fragmentation. It also seems like a lot of work to change a large, mature codebase to work with a GC that moves objects.

EDIT: Apparently my experience is not universal -- see below: https://news.ycombinator.com/item?id=15803046
If they're setting passwords just to prevent a bug, then yes it's a hack.

The same actions can be a hack or not, depending on what they're accomplishing.
More fundamentally, the value of a share of stock is tied to earnings. When companies accumulate capital beyond their horizon of their operational needs, they issue dividends.

Yes, companies can go out of business, but that's not the point Bogle is making. He's not saying stocks are riskless. He's saying that their valuations are tied to notional future earnings and the dividends they will generate.
Is it speculation by not participating in a market that has rapidly inflated? I think that's stretching the economic meaning of "speculation".
The biggest red flag is it's clear the exchanges don't have the liquidity for everyone to cash out. Since there are no banks to provide credit lines it's entirely dependent on people getting into the market to provide the fiat currency to cash out.

A run on these exchanges will destroy the value of bitcoins and cause a panic.
This is so exciting, can’t wait for all the open source contributions to RISC-V WD will make
Ok, "most" was the wrong word, but Roger Ver and Gavin Andresen were instrumental in the success of Bitcoin and they now support BCH.
I deleted Bash in Bash
> Sounds to me like he is just rambling a bit there at the end. Gold actually does have some intrinsic value—it's useful

Actually I think you are misunderstanding him? He isn't saying that gold doesn't have intrinsic value; he's saying it doesn't inherently generate more value.
Ask HN: Is there an API to get ALL Domains Registered in X timeframe?
I'm scratching an itch, and need a way to get all domains registered in the past 24 hours.

Wondering if anyone knows a package that might help in php/ruby/js or a web api for this sort of thing?
Why should the society pay for your dream to have a chance to be reality?

Startups with few heads have taken down companies that had employed hundreds gainfully for life, only to be folded into another behemoth with all the evil intentions. Whatsapp acquisition by Facebook where they decided to look into messages for profiling comes to mind. Countless examples of startups being open to being bought only to leave the customers hanging dry for options.

Do you agree to keep cost of shipping same no matter the size of your account (shipping one container vs. shipping thousands a month) so that some dreamer logistics graduate can compete? Would you pay to keep it fair? How about a pharma grad and keeping things equal against big pharma? Should you be taxed to pay for FDA approval process of every drug that a pharma student comes up with?

I am for Net Neutrality because doing otherwise turns paying customers into a product, and that goes against the contract. As an ISP customer, I am not willing to be made inaccessible by someone that I want to talk to, specifically when I am paying for that access.

At this point I am more concerned about Facebook/Twitter/Reddit/Google's ability to discriminate against people, than Comcast/TimeWarner/Verizon/AT&T's ability to discriminate against my packets. The later is hypothetical, the former is an everyday reality.

Freedom of expression is more important than cost imposed on buying the paper to write your expressions on. Net Neutrality is fighting over ability to write what you want on the paper you bought without the paper manufacturer consenting to your writing. Doesn't happen with paper, doesn't happen with packets. But the ability to show your writing on the paper to other people, their ability to read what you have written is being undermined, tampered with without repercussions, daily, every second of the day by Facebook/Twitter/Google/Reddit.

Net Neutrality is not the fight of the day, the battle cry is Freedom of Expression, fight against censorship imposed by Facebook/Google/Twitter/Reddit/YouTube.
It seems cool but it's way too hard to find actual code samples on that website. It would really help to grasp the language.