skysight-inc/HackerNews huggingface dataset:
My understanding is that the first attempt is creating/enabling the root account with a blank password and that the subsequent login is actually utilizing it (which is kind of bizarre and probably why this was missed in testing).
Create a root password.
Most of the big companies will take their sweet time to fix something if it suits them. Not always, but sometimes they just won't feel like getting around to it, and they know that as a "responsible" researcher, you will keep your mouth shut about it. I'm talking like a year. I've seen this with the "researcher friendly" companies.

In my opinion, there's a point at which it becomes irresponsible to let them sit on issues for so long, but their newspeak for the disclosure policy tries to pre-empt that idea.
It might sound very naive to say this, but I found it very cool that it was someone from the States, an Aussie and a Spaniard working on this, open source is something magical when you think about it. Props to everyone involved, all those projects sound like a lot of fun for a good cause.
So back in 2009 apparently I talked about funding models for open source http://www.linuxplanet.com/linuxplanet/reports/6808/2 I hadn't conceived of a Credo-style business model http://www.credomobile.com/ at that time but it would be really nice if it had legs.
WeChat is pretty big in Hong Kong now. I was on Hong Kong MTR last week and half of the people standing around me used WeChat within 10 mins.
> It seems like that argument easily ends up in the "educations that require significant debt are always useless" position, which is false.

That's not my position.

> "Reasonable" is a weasel word.

You can have a reasonable definition of what is reasonable ;-) It just has to do with the ammount of risk you're willing to take, yes, it involves personal risk.

But you can see, for example, in such and such people that get a degree are >70% unemployed or working in a different area that has nothing to do with it. Then well perhaps it's not a good choice if I don't have the liberty to do it just for the sake of it, without expecting money in return.

Some other career choices probably have better expected outcomes for the average Joe. So maybe if you need the money, chose that.

The bottom line is: it's just silly to live as if you were rich and but then after complain you don't have the money for it.
AppleGate
> It furthers the whole concept of DRM, but as a standard open to any party, thus not really damaging competition…

It damages (as the article states) the specific type of competition that is disruptive to the framing of Netflix-type business. I.e. there can be competition from a Netflix-clone but not from an innovative competitor who does something different building directly on Netflix in the way that Netflix themselves built directly on top of existing DVD markets to get started themselves.

Real innovation often involves this sort of non-clone, innovative, disruptive competition that doesn't just do something new but actually adapts the existing market in new ways. DRM certainly blocks a lot of that, and that is exactly what the DRM-advocates want to block and what EFF is talking about in stifling competition.
Idunno, that'd be an uphill battle in terms of branding, and you'd split the userbase even more than with a simple update
That so-called “cabal” determines what content exists on their network of connected machines, not what content goes online. The nature of the Internet is such that it is not one machine, nor a small group of machines, that decides what content is accessible.

I think concern over censorship on dominant, privately-operated platforms is fair, but Pai’s statement reflecting those concerns is simply untrue.
They're targeting the massive existing customer base for ActiveMQ, from the blog post: "SQS and SNS have been used extensively for applications that were born in the cloud. However, many of our larger customers are already making use of open-sourced or commercially-licensed message brokers."
Why do they have to overreact? They're smart. Often they're computers. Can't they just ... not?
Identity management is complex and boring.

Apples user management is even more complex than most Unixes.
> Apple created LLVM and clang

To be specific, LLVM started as an academic project by Vikram Adve and Chris Lattner in 2000. Apple hired Chris Lattner in 2005 to work on LLVM for Apple. Clang, though, does appear to have been an Apple project, being introduced by Steve Naroff of Apple in 2007 as an open-source project.
Maybe it was lost in translation of the quote, I believe those were references to the names of actual executives: Mark (Zuckerberg), Jeff (Bezos), Jack (Dorsey)
Block-a-thon Midwest aims to make Middle America a cryptocurrency leader
popular here in Seattle as well.
"To be honest, if I look back at my last 20 years on the internet, I have seen more colorable censorship from the Reddits/Googles/Twitters of the world than from the various satellite cos, ISPs, telcos, quagmiric microwave relay companies, and mobile phone networks I've used to get on the internet."

Which is due to Net Neutrality!

Take away Net Neutrality, and the ISPs etc. can also get in on the censorship game.
Just because someone with experience in the industry thinks it's a good idea doesn't make it a good idea :-)

Let's do an exercise: I don't know anything about tradeshow. Can you explain to me what you mean by content and how it's distributed currently?
I have the same problem with my cats.
> I'm having significantly less problems with Windows then MacOS.

I'm interested.. What kind of problems?

> But Windows and MacOS both give me more problems then a FreeBSD or Linux box ever has.

I switched from linux on the desktop to MacOs precisely because of the problems linux had - driver support, even LTS updates breaking functionality, and overall clunkiness. I run linux on all my servers.
Repressive collusion to fix salaries and restrict industry movement, doesn't really inspire your employees to try their best
Running linux in a VM condemns you to never really understand it
Yes, the government forces companies to do things. How awful. Here are some of the many awful things the government forces companies to do:

- ADA

- Non-discrimination

- Antitrust

- Health regulations

How authoritarian! I'm glad that the spooky A-word is scaring you into letting ISPs continue their money-grubbing practices. I'm done with that business. I hope NN sticks around and their lobbying efforts go down the drain (AKA into politician's pockets apparently).
I assume you haven't read the article, please read at least the introduction since it does a much better job of explaining the issue than I can.
holy shit, you people are fucking lame.
Windows 7 has been on the market since 2009 while High Sierra has been out since June of this year. I feel like we're not comparing apples to apples here.. I'm sure both companies are releasing security fixes consistently and Win7 has clearly had more of them in 8 years.
I don't appreciate the direction the nn discussion has gone. To me the core and fundamental principal of innovation and growth is connectivity - pure, raw, naked and unfettered access to an open network. I am and always have been able to choose any "edge" provider or network service or content I desire, always. This is not true with regards to simple connectivity. These two things are being improperly (nefariously, imo) tied together much like the access and content mergers - these two things simply do not belong together - access is not content is not access. I do recognize and understand the broader discussion around content and services when it pertains to inordinate impact, influence or control via overly influential and controlling services - services which, for the most part, we can still all choose whether or not to use whenever we want.

The only true and immediate threats I can currently perceive are coming from those controlling the gates to access. We've been robbed of the basic premise of title II protections for a vital communications service because we allowed the topic of discussion to change. "Network Neutrality" was never a good hook and now it has enabled the loss of focus on the core problem that is ISP service in this country. Twitter content? No so much.
HDMI Forum releases version 2.1 of the HDMI specification
The new Apple is the old Microsoft, and the new Microsoft is the old Apple.

After 8 months of living hell using their overpriced MacBook Pro, I'm moving to Surface Pro (running Xubuntu, though).
Mostly, they're just missing out on an up to $200,000 bug bounty.

https://www.theregister.co.uk/2016/08/05/apple_joins_the_bug...
Information, Physics, Quantum: The Search for Links (1989) [pdf]
The 'attacker' could be someone like your 12 year old son or an employee, who already has access to the computer but not necessarily everything on it at all times.

This would have been a pain for me when i was using parental restrictions to lock a 12 year old out of 18 hour a day Minecraft.
They will use some clever words to make it sound like a trivial issue like they did when password was appearing instead of password hint couple of months ago.
The first tip - red ocean/blue ocean strategy contradicts what these guys have been doing themselves - 1. take a proven "premium WordPress hosting/WPengine" model 2. use hip violet cartoonish website design as hundreds of other startups. 3. run affiliate program with huge payouts $500/referral (potentially). Now I'd take every advice mentioned with a grain of salt.
> Out of the whole RISC-V ecosystem it looks like only SiFive is working on that, so it will take time.

If you look at Qualcomm's strategy with x86 competition (using Dynamic Binary Translation), it's not hard to imagine that they might consider building RISC-V application processors; especially once they've proven their ability to deliver enough compatibility and performance with DBT to compete on ISAs for which their device is not licensed (and especially if they are sued by Intel and win, one of those things where you'd jump for joy if you saw a C&D in the mail).
There's no reason why the person who discovered the bug would be safer publishing the vulnerability on Twitter than disclosing it to Apple directly. If nothing else, they could always post it on Twitter later. The link to the DMCA is a digression.
Responsible disclosure is pretty much a security industry concept, it's not something that most developers know about, complaining on Twitter is probably what an average person would do.

Although for what it's worth last time I reported a security vuln to Apple using their official process they took around 2 years to fix it (admittedly low priority security vuln, passwords being sent over http).
RISC-V is just ISA. I don't think ISA's can be patented. Just some specific instructions.
SPECjvm98 is an outdated measure of both system and JVM performance, the benchmark to look at is SPECjbb2015 which very aggressively taxes JVM subsystems like the GC and the JIT.
There's a nice Jupyter kernel for Clojure: https://github.com/didiercrunch/lein-jupyter.
Optimal register allocation has been polynomial time for more than 10 years - for some definition of optimal. IIRC it started with programs in SSA form and has dropped that requirement more recently. Modern GCC uses SSA form and I think LLVM might too.
I'd be very surprised if that wasn't announced somewhere.

Guess it must be a specific bug that affected my hardware more than the average person then.
Did dad used to fix stuff in the basement, rather than "fiddle", everything now is made to break and be harder to repair than to replace ...
I expect that if I send a letter to the editor of my newspaper, that they are free to edit out any cursing before putting it in their newspaper.

I don't expect (or want) the post office to open my letter, read it, and decide to charge an increased fee because I mention it.

I don't expect (or want) the post office to open the reply letter, and add an advertisement for the new government owned camping that just opened.
I love Firefox Quantum and it has replaced Chrome as my browser at home. It's memory consumption is far lower with the same amount of tabs open.

That said, why does it perform slower than Chrome on most benchmarks? Is it due to the Chrome team doing much more grunt work regarding parallelism and asynchronous I/O? Or are there still features in the current Firefox build that still call the original engine?

Does Rust have a runtime penalty as Golang does?
Ive already said it twice: existing HELOCs get cancelled when the market crashes. It happened en mass in 2008. The bank says "You know that line of credit we gave you? We're taking it away." They also do this if your credit score drops. That's a big part of what got a lot of people into a lot of trouble in 2008-09.

They also usually come with closing costs and fees.

I don't have a HELOC because I have a savings account instead. Pulling equity out of your house like it's a checking account as a matter of course is a good way to lose your house. Putting 100% of your money into your primary residence and relying on being able to borrow against it (with interest!) when you need cash is really, really irresponsible and stupid risky. They can have their place, but not as a substitute for a savings account.
> The question is large and complicated, and people can agree to disagree

> There's nothing wrong with tweeting vulns

Those two statements seem to be contradictory. It seems to me there is still quite a lot of debate about which disclosure policy is best,
Except each of those companies has competition. Voat and Gab, among others, were born out of the idea that Reddit and Twitter were being unfair. And one had the ability to join one of those alternative platforms, even while still remaining a user of the original, without friction, largely because of having a neutral net. If we get ISPs offering "social media packages", what do you think the odds that Voat, Gab, or even Mastodon will be included?

If you believe that what Reddit and Twitter are doing is wrong, then why on earth would a reasonable solution be to extend the ability to do more of that to actors that one cannot reasonably avoid? I have a grand total of 1 ISP to choose from. The vast, vast majority of Americans have 1 or 2 to choose from. If NN is revoked, and Cox (my ISP) decides they're going to act like Twitter, then I have exactly no recourse. Why do you believe that is the way to go?
Subjectively it feels like Apple bugs have become larger and more prevalent, over the last few years. That and IMO clean OSX/iOS installs don't quite feel as polished as they used to. (I stopped using Apple products, except for a MBP, for a few years and recently started using them again, and the MBP still runs 10.10 for precisely this reason) The last solid OSX release was Snow Leopard
If even 10% of the battery 'breakthroughs' we've seen on these pages in the past 5 years had come to fruition, we'd have 20Kw batteries that charge in 10 minutes on our phones. Oh, and they'd be 100% recyclable but that wouldn't matter because they'd last for 100k cycles.
Really? What driver support on a desktop were you experiencing?

I've run Linux mint on my desktop at home for a few years now and have had zero problems at all (Intel i5, Nvidia gfx, wired connection).

The last time I had driver issues with Linux was ~10 years ago and it was for a laptop running Ubuntu.
Add in : asteroids in close orbits around suns developing life elsewhere (or here). Precursor chemicals to life surviving the asteroid trip even if whole organisms do not (accelerating life development on Earth by millions/a billion years).

We started with, it took an Earth to develop life, but if it came from elsewhere we'd have to expand our ideas to include all other possible sources of life, not just Earthlike. Because our premise changed.
Thanks for posting the link. We have a deep dive at re:Invent later this afternoon if anyone is interested in attending.
I just have no words, it seems intentional. They may want to review their build pipeline to check someone didn't manipulate the source code before it was signed. I haven't seen an easy root priv-esc like this in a long while.
Ask HN: How to incentivize payers/employers/govt to invest in mental health?
I posted this article about the moral urgency of mental health

https://news.ycombinator.com/item?id=15790910

A HN user replied with a comment I found interesting

> This doesn't touch on a potentially even bigger barrier to adoption of better mental health care: that those who benefit from better mental health care often aren't the people paying for it, and that it is really really hard to measure the specific financial benefits of improving mental health in a way that will convince payers / employers / government to actually put real money on the line

> user: aaavl2821 https://news.ycombinator.com/item?id=15792204

How would you incentivize payers/employers/govt to put $ into mental health?
You should consider adding gradients in addition to flat colors!
Maybe something like this was added to make debugging/testing of the OS easier? maybe they just forgot to remove it before shipping the new macOS
There are and have been other build tools besides rebar.

The Cowboy web server uses a makefile-based tool.

https://github.com/ninenines/erlang.mk

Some of the reasons why.. https://erlang.mk/guide/history.html
Want something similar without the lock in? The community has recently added GraphQL query capabilities (including realtime updates, like Firebase!) to gun, fully Open Source: https://github.com/brysgo/graphql-gun (note, I'm the author of gun, but not the GraphQL extension)
And Full disclosure is about protecting users of a software, not letting the vendor off the hook. Here, the hack and the fix are so trivial the responsible thing to do is to publicly call out Apple for its lack of QA and warn users directly. It affects everybody who runs High Sierra.

> it puts millions of Apple customers at risk in the process.

Nah, it's Apple which put millions of customers at risk, not the person who disclosed the vulnerability. let's not shift away the blame from the guilty here.

Apple one of the richest company in the world is obviously just cutting corners in QA here. This is unacceptable.

it's seems some people here are more concerned about negative publicity than user security. This is a pattern that have been seen countless times in big tech corporations(such as Yahoo), not disclosing hacks that put their users and their data at risk. This is unacceptable for a company that claims to be all about their users.
Ask HN: If you could, how would you set up Airbnb's servers from scratch
I'm running an alternative to Airbnb for the tech and crypto community (www.cryptocribs.com). Yesterday, after being live for just two months, my servers already crashed. It turned out that with only about 500 listings, I already ran out of the 20GB storage I used for the setup. I currently run the site on a basic Digital Ocean droplet (1GB/1CPU, 20GB SSD/ 2TB Transfer). Turns out that every listing is already about 50MB and this adds up quickly. To solve the data storage problem, I now resized my droplet a bit and also bought a 100GB attached volume. I am planning to do a NGIX alias redirect for the image files to store any new files in the extra volume. But I feel like there must be a better way to do this
Reminds me of the time Mac OS X would trust any NIS server in the local net to authenticate local root. Can't find the story though. Did that even happen?
I think it's a mix of different reasons.. I think there is a correlation between events in North Korea and trading volume in South Korean exchanges too
> But since I don't work there, I have no good inside info

Actually, I've been wondering why I hear less about people working at Apple than at other big tech companies. It seems everyone and their mother work at Google or Facebook, but no so much at Apple. Do they have less software engineers, or their employees are required to be more discrete?
Starting with OTP-20, the string module handles unicode, both for binaries and lists (and iolists, which mixes all styles) without a problem.
White collar tech bros will not hold up under investigation. A ivy-league mba has way too much to lose to risk going to jail over some stock options. Doing this kind of dirt can only survive via staying under the radar-- somebody is gonna flip and this whole house of cards is gonna go down in a stampede of Uber employees rushing to drop the dime on each other.
As Bitcoin surges in value, Elon Musk denies he's its mysterious inventor
> most benchmarks

Which benchmarks are you talking about? It depends on what those benchmarks measure.

For example, a lot of the Quantum work was in user-percieved UI latency; unless the benchmark is measuring that, and I imagine that's a hard thing to measure, it's not going to show up.

> Does Rust have a runtime penalty as Golang does?

Rust has the same amount of runtime as C does: very very little. https://github.com/rust-lang/rust/blob/master/src/libstd/rt....
There're a lot of attendees from a lot of companies, they can be vulnerable.
Bonds, precious metals, ETFs tracking industries that do well during downturns.
But Widevine is not just one system, there are multiple security levels. Software-only version (L3) that runs in chrome CDM on desktops (SD quality) can be defeated easily (it uses arxan's TransformIT as an OEMCrypto implementation), but in order to break L1 you'd need to break into the TrustZone which is much harder, and even if you did it on a particular device, Google could revoke certificate for that device or even device model.
I would say I'm surprised such a serious bug made it out, but after the A � thing who knows what's going on at Apple
Closed disclosure does, to a large degree, prevent negative publicity. I don't think it is in dispute that this bug would receive vastly less media coverage if it were only revealed as a bug in outdated/patched versions of the OS.

I don't want to see Apple hurt (I'm an Apple-guy myself, using Macs, iPhone, iPad and Apple Watch), I want to see them improve. I doubt they start will start caring about QA unless they're forced to.

One absurdly serious and stupid password bug like this can be a honest mistake, but three (that we know of, that were full disclosures) in a few months is negligence that should be criminal if it isn't.
Sorry to plug my (guest's) stuff, but this sounds like the kind of thing Lean Startup is designed to help you handle more efficiently and effectively.

Ash Maurya came on my Sales for Nerds podcast and talked about it.[0]

I remember saying something like "I wish I'd known this 5 years ago."

And he said, "me, too." ;-)

[0]: https://www.salesfornerds.io/episode-7-ash-maurya-on-scaling...
it is also that they pursue features just for the sake of it. things get moved arund in the iPad from release to release for no good reason, often going backwards in usability. every release i have to relearn simple things like how to manage the screen brightness. i really wonder what they are thinking internally other than “we need to shake things up to make it appear we’re doing something with stale products”.
Jason Fried's whole business philosophy comes to mind [0][1].

[0] https://m.signalvnoise.com/why-we-choose-profit-e511efc4dcb9

[1] https://m.signalvnoise.com/exponential-growth-devours-and-co...
Why You Should Invest on Revamping Your Website
It doesn't, though. There's also the concept of "free association," which is included in "free speech".

Look at it this way: HN is a very heavily moderated board. There are lots of troll posts and spam posts that get removed, usually pretty quickly. Do you believe that's a good thing, or a bad thing?
Advanced RISC Machines (ARM) doesn't seem to have suffered from the association.
Does it slow down your phone?
Anyone in a position to short AAPL? It's apparently 6bps up in after hours trading but that's very low liquidity.

https://finance.yahoo.com/quote/AAPL?p=AAPL

A higher risk, higher leverage bet: buy some put options the milisecond markets open:

http://www.nasdaq.com/symbol/aapl/option-chain