skysight-inc/HackerNews huggingface dataset:
> If Cox decides to get in on the censoring game, and I don't like what they're doing, I can't do a thing about it.

Agree, that's the main issue. If you could choose between 3 ISPs then the one with less censorship and throttling would win and others would be "squashed" by the market. There would be no need for net neutrality rules. But in some areas there is just one provider so nothing can be done. And it's not a new thing, it's been years for the market to grow and develop, but it hasn't.

> If Cox decides to get in on the censoring game, and I don't like what they're doing, I can't do a thing about it.

It's a good point, however practically they have no financial incentive to censor based on content. Yeah if could one day, so you're at their mercy, but so far their censorship has been around extorting higher fees either from you or from services you connect to (Netflix, Google, Facebook etc). Verizon for example throttled my Youtube and Netflix even as I was paying a premium for high tier "FiOS" or whatever it was called package.

Google, Twitter, Facebook on the other has been engaged in a more dangerous censorship. We saw the story yesterday about FB squashing posts from Romanian protest organizers. So in that respect it is closer to the classic silencing and squashing of free speech.

Calling them out and taking a jab at them doesn't seem terrible. It won't save net neutrality at this point but if it forced or embarrassed those companies to reduce their censorship it seems worth it.
I actually do think it is in dispute. This is a tweet after all. This guy could totally tweet about it in much the same way after Apple released a patch. The negative publicity would still exist because the bug would be equally stupid and disastrous, just fewer people would be harmed along the way.
True.

I think we can say that Gecko ended up technically better than incremental changes to Internet Explorer, which I think was starting off from a more maintainable codebase than Netscape 4. That's hardly conclusive but it's some evidence.
I have been in the apple ecosystem for about 10 years. For a company that has been priding itself on end user security, the bugs that have been creeping their way into the OS are just... disappointing. What is the point of paying a premium for a well polished hardware/software bundle if the OS is malfunctioning in a non trivial manner. Design? Right now when I use my calculator app on my iPhone and do 2+2+2 I get 24. That's a pretty awful design. Actually, it's a lie.
Value First, Price Second: Making good decisions in life and software development
Thanks a great point, avitzurel! This will be exactly one of the core offerings what we're currently working on at Graphcool.

AWS provides great building blocks but using them efficiently is a major challenge (especially for smaller teams). Like in your case, there is an enormous potential in better resource utilization!
Isn't this basically a copy of Graphcool?

I was actually just about to comment how it sucks for startups that AWS will just grab every good idea, duplicate it and draw a lot of business because, since you have everything on AWS, it's very tempting to just use their offering.
This is the most idiotic thing I've heard in a long time. Yes, they were already at risk, but with the way he disclosed the information, the risk increased exponentially. This guy's actions were either stupid or malicious.
Not a remote vuln, who gives a shit. Physical security >
I mean that article goes on and on about how anti-Marxist the Nazis were. They essentially claimed that they were the "true" socialist and Marxists weren't. Much like how North Korea would probably say that they are the true democracy and everyone else isn't.

> Our adopted term 'Socialist' has nothing to do with Marxist Socialism. Marxism is anti-property; true Socialism is not

> The Nazis claimed that communism was dangerous to the well-being of nations because of its intention to dissolve private property, its support of class conflict, its aggression against the middle class, its hostility towards small business and its atheism.[205] Nazism rejected class conflict-based socialism and economic egalitarianism, favouring instead a stratified economy with social classes based on merit and talent, retaining private property and the creation of national solidarity that transcends class distinction.

So they did have their own definition of "socialism" that they met, but that definition had virtually nothing in common with the way that the rest of the world defines it.
Ask HN: Which open mathematical problems block immediate technical progress?
Are there any problems in math which, if solved, would immediately impact technology? Doesn't matter which type of technology.
Unfortunately, @CSaid mistakenly used Waymo instead of Uber in a few places, but she did have an interesting tidbit I haven't seen in any of the subsequent articles[0]: the former employee of Uber claimed that he was reprimanded in a performance review and then demoted for "not protecting more info from discovery." How is that not a huge deal?

[0]: https://twitter.com/CSaid/status/935573560461967360
It's a fine enough use of "obviously", and they don't mean it from a legal standpoint. If you were an editor of the article, you could probably have convinced them to change the sentence to say "…obviously not a copying issue…" instead of "copyright infringement" or some other nuanced edit. This is nothing more than being super picky about the exact wording in one sentence.

You make good points, and I appreciate your response, but I think the issue goes deeper than the wording. If your reading is true, then I'm bothered by the complacency of the author in allowing the reader to conflate the legal and the logical. If this were an editing oversight, it's forgivable; but as a rhetorical strategy I find it deplorable.

While that may be a fine enough guideline, there certainly can be judges, even on the SCOTUS, who argue against what is "obvious".

Sure, but given the manner in which Supreme Court cases are chosen, it's exceedingly unlikely that a case would make it to the level of the Supreme Court unless there is something non-obvious (or at least disputed) about the matter.

Reductio ad absurdem: if a law is passed saying that it shall be considered "homicide" if a fiction author describes a murder in a book, it would still be perfectly sensible to say, "that is obviously not homicide".

And if a law is passed that says a drawing depicting a tentacled monster having sex with a cartoon child is legally classified as "child pornography" is it also reasonable to say that a cartoon is "obviously not a child" (http://ansuz.sooke.bc.ca/entry/335)? Possibly, but it would be disingenuous for an expert on that topic to do so in an article discussing that exact legal debate in a manner that is likely to mislead the reader.

The only weird part of their sentence is that "copyright infringement" is a legal wording, and they were using it to refer to the concept rather than the legal interpretation.

I think it's a conscious strategy rather than a weird detail. The fashionable term for this sort of approach is "motte-and-bailey" (https://philpapers.org/archive/SHATVO-2.pdf), and involves intentionally conflating two concepts, one which is easily defensible and one which is not. The base question for me is whether or not the author is consciously using a rhetorical strategy that involves misleading the reader, not with whether some degree of simplification is always necessary. It makes me doubt the strength of an otherwise reasonable argument when an author intentionally adopts such a strategy, and I think Doctorow is a good enough author that I start with the assumption that the rhetorical effect is intentional.
This is a constant challenge I have faced in leading software development teams...

The tendency, especially early on in a product's lifetime, is to think everything is a top priority and therefore rely on the development estimates (i.e. price) to decide what to build next. But that's like looking at the restaurant menu and picking the pumpkin soup and the tofu burger because they are cheapest when your customer would actually prefer to wait and just get the delicious steak.
Kind of OT, but I've noticed both latency and battery-life hits for compositing WMs in X (compared to traditional WMs).

Are those things being measured at all in FF? It may be that the tradeoff is worth it (and I have no doubt it can be done better than the median compositing WM on linux), but it would be good to have that data.

On the other hand, it may be moot if Wayland does end up taking over from X.
It's the exact same thing with solar panel technologies. But then if you look at the long term, 10 or 20 years, you see that there really is an underlying current (...) of steady improvements that eventually make it to the market or that reduce cost. But the vast majority are hype.
The catch is that my math is wrong and I meant $97B. Thanks for the gut-check.

I'm still interested in doing or seeing an analysis with the full Fed dataset.
Not sure if this is normal, but I have very noticeable lag in the search/address bar autocomplete which does make the whole browser feel a bit slow (MacOS Sierra, using Developer Edition).

And since we are here, the prompt/dialog windows in FF are still not native looking too. These are my two major complaints :)
$210M ICOs and 5+ Unicorns on Future of Cryptocurrencies and Blockchain Roundtable
> Arguably, what they’re doing is better than sitting in front of a passive device like a TV.

But the example given was of a child semi-actively watching ads, for hours and hours. Is that better than watching, say, Sesame Street?
kys loser.
The people then were the same human species as today, and there's no reason to think that they understood human nature any less (in fact I think people today have a lot of trouble understanding human nature).
This does not work if the root user has not been enabled locally.

Source: Just tried it myself.
> Citation needed.

Has there been an update released yet? I wouldn't know, I don't use OS X.

Is this the best way to report a security flaw? Of course not! Is it a bad way? No! The only bad way to report a security flaw is to not report it at all.
If you're wondering how to disable it, the menu option can be found here:
https://support.apple.com/en-gb/HT204012
URLs have been a security issue for browsers in the past, and can get pretty hairy. From UTF-8 coded domain names to whatever you want to "urlencode". For example, you can encode whole images into URLs, for embedding them in CSS files.

Old IE versions had a hard URL length limit and were very picky with the characters in domain names, both limitations included as "security fixes" (which broke the standards).
Where did you hear that the keyboard was pulled from the channel? It just seems to be out of stock for me.
> People have the freedom to use bandwidth to go to any site they like to.

Especially if they are already paying for it monthly.

Google/Twitter/Etc can all at least say "you are not paying for this just mooching off of our infrastructure, don't whine when we delete your post".
Uber is just trying to fit in the taxi industry:

https://www.nytimes.com/2017/06/07/nyregion/taxi-king-is-cha...

http://www.nydailynews.com/new-york/taxi-king-nyc-sexually-h...
> it'd also need cheaper buses to be able to afford enough of them

Tesla to the rescue! /s
my emacs gc strategy: disable the gc. do manual collections by restarting every now and then.
You can go about it both ways: file a bug report, put a reasonable date that you want them to fix it by. Then you can disclose it.
MIT and edX have already started doing this with the Supply Chain Management MicroMasters [1]. Other universities are coming aboard soon with other MicroMasters [2].

[1] https://www.edx.org/micromasters/mitx-supply-chain-managemen...
[2] https://www.edx.org/micromasters
RISC-V Spins into Drives, AI
It may only behave like that in some particular conditions which didn't come up in QA.
Does that make it OK? I mean, something as important to the web as getUserMedia is broken on websites only if you pin it to the home screen. Forcing people into Apple's walled garden doesn't seem like an acceptable excuse.
Maybe we're mostly made of coopted virus fragments? Could be intelligent apes were spawned not by mutation but by viral meddling, however inadvertent it may have been.
Ah, there's no ShadowHashData or KerberosKeys nodes. Presumably the code creating that plist is not aware that later on it's going to be accessed thru layers of other software and end up as a usable login. To quote Shrek:
"Software is like an onion".
> It's practically a joke compared to its perceived might in 2013.

But it's a lot worse than we thought before Snowden. And with stuff like this erring on the side of caution seems like a pretty good idea.
OK, but at that point, the "billions of planets out there" argument doesn't work. You're left with the probability of it transferring from a nearby planet.
Zero-day disclosures aren't about negative publicity in order to prevent problems further down the road some time in the distant future.

It's about protecting systems RIGHT NOW from immediately causing harm to people's lives.
Cause this stuff is illegal and high profile. And Uber has been skating if not nakedly flaunting the law for a long time now. If the DA starts sniffing, people are going to start talking.

Furthermore, the odds of the leaks continuing approach certainty at this point. Even in a civil trial, who would perjure themselves over a job? (Pleading the fifth is a potential option even in a civil case, but is real problematic and probably will make a criminal investigation even more likely.)
Central locking has a bit of a learning curve anyway. Used to be, every door was locked individually. With central locking, now your trunk might be set to unlock with the car, or it might stay locked regardless of the central locking status. Or maybe you hit a button that unlocked (but didn't unlatch!) your trunk, and now it's just waiting for someone to press the button and open it. Those problems aren't made worse by this tech, though; they've been around forever, and it's certainly confusing in a rental car context. (How many drivers have called the rental car agency confused about not being able to get the car out of Park, not realizing they have to depress the brake to shift into gear?)
This isn't a fix, it's a hack. A computer with a root password is inherently more insecure than one without a root account at all.
Don't disable root. The bug re-enables it with a new blank password.
I dont understand the implied correlation between, what you call, irresponsible disclosure and "wanting to hurt apple". Where did you get this impression from?

edit: Typo.
Washington State AG Bob Ferguson Sues Uber Over Data Breach
No, they don't have groups and each meeting on Eventbrite is a separate event, which makes it difficult to see past meetings.
"Apple root bug appears to be triggered only by logins coming from com.apple.loginwindow.
Running "su" with a blank password won't get you a root shell." [1]

As for your subsystem argument, explain this: https://www.youtube.com/watch?v=OobLb1McxnI&feature=youtu.be...

[1] https://twitter.com/0xAmit/status/935609423485169664
Prove P != NP
Wow what a crazy device! That link led me to Elie Bursztein's youtube channel where he posts all of his defcon talks (or at least a lot of them). They're all really good!
I give him points for cleverness but saying 'names like' is still not so subtly saying that it's because they're white men.
It's used as an idiom, meaning roughly "I have total confidence".
Huh. I've never seen one like that. The ones I've seen (Infiniti, BMW, VW, others I'm sure) unlock when you put your hand into the door cup to grab the handle. They lock by touching an area to the side of the door handle in some way; an action that can't be confused with the opening action.
Original source (that i should have linked... mods wanna gimme a hand?): http://www.atg.wa.gov/news/news-releases/ag-ferguson-files-m...

Actual text of the complaint: https://agportal-s3bucket.s3.amazonaws.com/uploadedfiles/Ano...
Welcome to Hacker News: "We're Reddit with a better vocabulary!"
https://fred.stlouisfed.org/series/T10Y2Y
Haven't deadlines at Apple always been driven by marketing? I'm looking for a source but I remember a story where the product director for iPod was told by steve jobs "make it simple, fast, beautiful, and have it done by Christmas."
Right, and the inevitability of it being present in a nearby planet went way up. Because once it started somewhere (and there are billions of 'somewheres') it would spread like a virus and infect every possible receptive environment.

The statistics is hard. No simple counting of planets is enough. All the vectors have to be accounted for.
As someone who once tried to write code to do it to avoid pulling in a dependency.

Never again, it's not just that the spec is 60 pages long but that the actual behaviour out in the real world is miles away from the spec, the web is a complex place where standards are...rarely standard.
WD had already been a RISC-V foundation member before their involvement with Esperanto Technologies (who has also been a member for a while). I suspect they saw Esperanto's portfolio and team after meeting at one of the workshops, and bought into it because of preexisting interest in RISC-V.

Just to be clear, I think they bought into Esperanto, but I don't think they acquired it. Much public communication implies that Esperanto Technologies is still generally autonomous[0][1].

[0]: https://twitter.com/rickbmerritt/status/935600820300713985

[1]: https://twitter.com/EsperantoTech/status/935598028773138432
Unfortunately it's still more common than you think.

The other day I actually ran across some AWS docs which suggest you send your AWS root key id in the url of http requests:

http://docs.aws.amazon.com/AlexaWebInfoService/latest/index....
>>> len("3.141592653589793") - 1
16
>> math.log(2**51) / math.log(10)
15.35252977886304

The precision of pi used by NASA is suspiciously close the precision limit of IEEE 64-bit floating point integers, a reason which is not given the article :). Interesting nonetheless.

edit: formatting
The fact that you as the ordinary student can become root and create a lot of damage so easily is the only reason the public will care.

Us geeks have been complaining about the horrible QA in macOS for years, yet nothing has been done. The fact that this is so simple to do will probably/hopefully get ordinary people to start talking about it too ("Hey, have you heard that you can hack Macs without a password? Very insecure"), which would force Apple to improve.
Leveling Up as a Data Scientist (Part 2)
The other day I was reading what it takes to generate HDMI signals down the cable. Why can't we have a "here are the 1980 pixels for line 1009" or "set 100,100 to #ff0000" or, still, "paint the 8x8 cell at 20,10 with this bitmap" protocol? TVs have enough memory to hold a couple frames, at least and certainly more than enough brains to drive such a thing.
Ugh, that's confusing.

Many cars unlock the driver's door only by default (assuming using a keyfob) but have the option of setting it to unlock all doors.

One neat thing about VW group cars (VW, Audi, etc) is the ability to use VAG-COM to reprogram a dizzying array of car functions. Other vehicles have this ability (BMW comes to mind) but require extremely expensive dealer-only tools to do it.
Lessons learned from 4 years of using Cordova in production
My VW keeps the radio on until the driver opens their door; passengers can get out with the engine off and the radio keeps playing, which is nice.
Obviously this isn't the best way to disclose a security flaw.

That does not make it malicious.

Sure, there are more malicious people aware of this security flaw, but there are also more users aware of this security flaw, and the simple steps they can take to mitigate it.
They could have at least used "rms" instead of a blank password.

https://www.reddit.com/r/linux/comments/7hj6v/i_use_my_login...
The Surprising Evolution of Dinosaur Drawings
Had one on FF Android but none on Linux since 57 release or in FFDE.
Very interesting article. My dad, an engineer, had the successor to this model, the HP-45. It was an amazing machine for it's time. Because of it, I fell in love with RPN and refused to use anything else. When I went to college I got an HP-48sx. I think it was the zenith of scientific calculators with so much functionality crammed into it.
Like an illusionist hiding the truth, this bug too will have a logical explanation that will leave us in wonder for as long as we aren't told how it happened.
Code Complete, Clean Code, and Debugging were profoundly educational to me as a junior developer. The Obstacle is the Way helped me deal with personal issues, but it's still a work in progress. The Joy of Less was a great introduction to minimalism. I just started reading Neuromancer but its got me hooked on the scifi/cyberpunk genre.
When you want to make a formal scientific claim - that technique A is faster than technique B, for example - how do you support that using a standard deviation as an error?

I sometimes have used standard deviations for errors myself, but I'm not really sure I can defend it.
I haven't dug through all the marketing speak yet but this seems like it's tangentially related to WD's He8 converged servers they've been sampling, which were ARM-based and ran Debian Jessie. [0] Although when I saw them spoke about in Redhat Summit of course they were mooted to be running RHEL. It would be interesting to see if WD Labs is now sampling RISC-V-based boards running Redhat and Ceph OSD software which like the He8.

I found the whole concept of on-board PCB with dual gig ethernet ports fascinating and I believe there's a second generation with faster network speeds. Unfortunately WD never seem to have gone mainstream with it.

[0] http://ceph.com/geen-categorie/500-osd-ceph-cluster/
Exactly, how can this happens and no one asks.
And, as a bonus, there's the other URL standard, which describes what browsers actually do:

https://url.spec.whatwg.org/
> Apple only responds reliably to PR storms

They've been quick (within 45 days) to patch every major bug I've reported to them and where the bugs were cross platform, impacting Windows, Android, etc., they've consistently been amongst the quickest to issue a patch so I'm not sure how you qualify that statement.
"Disclosing a 0Day... isn't cool,..."

But it is not nearly as uncool as releasing software to millions of paying customers containing a 0Day. Who knows how many people already knew about this and other 0Days and have said nothing?

The carelessness in releasing software with 0Days is especially unforgivable when the company has more cash on hand to pay employees than any company in history. What is their excuse?

Apple can afford the very best. Their customers pay the most. But the software they release, no matter what their user may want to imagine, is most certainly not the very best.

It is not even as good as open source BSD from which OSX is derived, maintained by unpaid volunteers, which does not allow remote logins as root without a password.
Yep, just saying that if he's not malicious (intending to maximize harm to users), then he's an idiot for disclosing it this way.
The bug isn't in the disabling, it's in the auto-enabling on attempt.
Yes, of course, but it's IN THE CLOUD, don't you see?

I'm waiting for 10 years from now when we rediscover the ability to write native applications in one language that run on the local OS & processor. No doubt it will be promoted as a magical cure-all elixir.
Hard drives already have moderately powerful processors in them. So there's no reason to assume any change in feature set.