skysight-inc/HackerNews huggingface dataset:
I've seen lots of places that think they have a process in place that prevents this. I've very rarely seen places that actually had sufficient security in place to prevent someone with malicious intent from actually finding ways of bypassing it if they were prepared to break company policies and/or the law. I'm sure they exist, and more places ought to take this seriously, but part of the problem is a lot of places think they have processes in place that ensures they're not vulnerable.

Often it boils down to not taking sufficient measures against social engineering. In this case the claim is they used fake usernames - most places I've worked, successfully getting a fake account if you already work there would tend to "only" require a willingness to lie on a form or two ("fake" a contractor) and then request elevated privileges. Very few places I've done work requires sufficient checks or counter-signatures to require additional accomplices or make it harder than that. They do exist, but they're rare.

The state of security most places is quite depressing at times. Then again, most of the time it's enough.
Yeah, I remember reading that. It was a little horrifying to read but, in my experience, stuff that's written in an inflamatory tone is about 50% less dangerous than it seems.
So the deployment team could write and push malicious code to production?
IPv6 brings some pretty nice features in terms of network engineering.

the major one is a vastly smaller BGP routing table, which is becoming more and more of an issue.[1]

We need IPv6 to remove the horrible IPV4 space fragmentation.

http://bgphelp.com/2017/01/01/bgpsize/
It's actually just as easy with IPv6. All you need is a stateful firewall which allows all outgoing connections and only allows incoming packets for already established connections. This was the default setting on my home router and behaves exactly like a NAT.
Quick! Someone plug these into an adversarial network!

Great work OP!
How to increase file upload size in ASP.NET Core
nice forum,check it out https://www.bit.ly/2M0hqJa
Quite a lot of these look _very_ close to existing brands. Close enough that if you do something similar to them using it you're probably going to need a lawyer.
> In the H-Bomb example, what would happen if Oppenheimer didn’t help develop the bomb? Russia most certainly still would have. And the world would be a different place today.

Russia (or well, actually the Soviet Union) stole the atomic bomb plans via its spy network:

"Although the Soviet scientific community discussed the possibility of an atomic bomb throughout the 1930s,[4][5] going as far as making a concrete proposal to develop such a weapon in 1940,[6][7][8] the full-scale program was initiated only in response to the intelligence reports collected by Soviet intelligence through their spy ring in the United States on the secretive Manhattan Project." [1]

That's the problem with your reasoning ("but they are doing it as well" or "they will do it as well"). Your reasoning is what escalated the Cold War and almost brought us WWIII.

[1] https://en.wikipedia.org/wiki/Soviet_atomic_bomb_project
Either the competent pulls way more than their weight, or luck.
There may have been. The article speaks of the employee using "false usernames". Code review may stop some foolish person pushing broken code, but it's not going to prevent a determined saboteur who's masquerading as other authorised users.
Isn't the same true of HTTPS (first developed in 1994, but has only seen wide usage recently, outside of specific use-cases), or even programming languages like Python 3? At the end of the day, it seems to me that incumbent internet technologies that are widely used will always see slow incremental change to a new incompatible version, regardless of how small the changes or how many improvements there are, without significant and clear external incentives. Such incentives are very hard to manufacture - so foresight of upcoming issues (such as IPv4 address space depletion) will always seem premature until they actually occur. But it certainly doesn't make forward planning a bad idea.
It is easy enough with home routers (packet filtering is hidden from the user, and no need to configure it). It is much harder for corporate networks where you need to configure everything yourself and maintain ACLs. No more easy default option.
Kasuo Kashio, co-founder of Casio Computer, dies aged 89
NAT is not a firewall. You are confusing the firewall function of your home router with NAT. NAT does nothing to prevent packets from flowing into your network, as NAT hole punching is fairly doable to accomplish.

Also, all consumer routers simply block any incoming IPV6 packets, this has been the default for more then 10 years now. (the only thing not blocked is ICMP for MTU path-discovery, which is actually a good thing).
Everyone and their mother uses TFTI. This is satire right?
perfect, exactly what I needed !
If anything, the stock market discourages this, because without it, people with a lot of money invested into things wouldn't be able to liquidate it at any price (before the investment matures), so they'd be more motivated to deploy illegal means to protect their wealth.
what? this makes no sense?

For a corporate network, their requirements usually result in them having to manage their own ACL's anyways. It does not matter if that is IPV4 or IPV6. There is no "easy default" for corporate networks because they don't have easy requirements.

On a enterprise grade firewall/router, the end rule of an ACL is a DEFAULT DENY ANY ANY, on both ipv4 and ipv6. (this assumes you actually enable ACL's. But that depends on your platform).
all food in the United States must be made without trans fat

Sloppy reporting. There are naturally-occurring transfats (in butter, for one example). Not all transfat is PHO.
I pointed out the problems with this boilerplate spiel that you keep posting over and over to Hacker News, 5 months ago, ironically in a thread where you triggered exactly the same side-discussion yet again. I see that you have not changed the boilerplate.

* https://news.ycombinator.com/item?id=16039947
Watch Your Hack – a layman's guide to protect yourself online
> to supplant real life goal obtainment with virtual status/achievement.

If you achieve a world first in an MMO, that achievement is as real as winning a sports championship. Even if you don't do something with a competitive component, some gaming achievements are as real and can be meaningful to the individual as something like climbing a mountain that everyone has climbed before. I don't agree that it is any way helpful to just characterize games as some kind of fake activity that requires special attention. Other nerd-like activities would be anime watching and book reading. I would argue both of those have examples of extreme addiction.

The diagnosis criteria makes clear that the problem is when you start sacrificing normal life functions to get your fix. Lots of marriages have fallen apart while one partner was out playing golf. It doesn't matter how much time you spend on something, what separates a disorder from a hobby is when you are letting other responsibilities suffer.
Why Are Institutional Investors Not in Crypto Market Yet
Why is every researcher treating addiction like it's bad behavior that needs to be avoided in order to be cured, instead of researching ways for humans to keep on getting the satisfaction, while curing the side effects?

(I know "curing the side effects" sounds bad, but it's basically what we want).
Ask HN: Why do you keep doing what you do?
Are you me? I had this exact same experience with the Diablo 2 manual.
thank you for sharing, it's really good.
Arcades absolutely did promote addiction, they just sucked at it compared to today's games.

In a classical arcade, you walk into a darkened room filled with animated CRTs and strange noises. They literally have blinders, designed to shut out your peripheral vision so the game is the only thing in your consciousness. When you die, you have 30 seconds to insert more coins and continue, otherwise you have to start all over from the beginning. Pretty much everything about this is designed to trigger your adrenalin-based threat-and-reward reflexes.

If modern computer games are more addictive, it's only because they've figured out how to trigger even more powerful primal instincts. MMORPGs and MOBAs add a social aspect, and very often a cumulative acquisition aspect (experience, gold, credits, etc). Simulations and worldbuilders like SimCity, Minecraft & Factorio engage our higher brain centers like planning and optimization. Mobile & casual games have figured out how to squeeze gaming into even smaller timeslots within our lives.

It's also interesting how gaming & gambling have converged. It used to be that a slot machine was a machine where you pulled a lever and tried to match up dials. Now you walk into a casino and it basically looks like an arcade, with lots of computerized gambling games on backlit LCD displays, while Internet games like CryptoKitties let you play & trade with real (well, fake) money.
Shorting should be illegal.
Director of NEO on Data, Facebook and Blockchain
In the financial industry part of SOX is segregation of duty.

As a developer I'm not allowed to have write access to any production system, except in an emergency via a break-glass mechanism, which is audited to the hilt and back.

It also means we're not allowed to deploy software to production systems. This has to happen via a specific chain development > regression / user acceptance testing > production.

All those environments need to be physically seperated with very specific access requirements.

The deployment process needed to be signed off by outr auditors.

I can't speak for other banks, but they probably need to implement the same -, or a similar system.

Neither can I speak for SOX requirements regarding software fo car manufacturing.
But wouldn't the correct response be to rectify the state/govt, rather than stop working on the tech?

Just because some select group decides that it's their moral imperative, doesn't mean everyone capable of the research has the same feeling, and therefore, any Govt who wants to stay ahead of the pack must be doing the research.
Not sure we can blame bootcamps - I learned nothing about internet security in my software engineering college course.
Part of Sarbanes-Oxley is to make sure IT systems are not manipulated. This includes regulating access to systems and controlling software development. Mainly this means, people who write code can't push code into production systems on their own.

One person writes a requirement, this needs to be OKed by another person, then a third person writes this code and it's pushed to production. Controls are setup - e.g. checking JIRA tickets in git logs - that no code without proper authorization (corrrect JIRA status) is pushed and deployed.

People need to be able to trace every code change to the requirement and the OK.

In the core this only applies to systems that are in one way or the other relevant to financial data (like ordering), but auditors usually want to be better safe than sorry. But Tesla might have a SOX-IT and non-SOX-IT.
Videoblogging Before YouTube (new book)
While I'm all for FOSS, I wouldn't use these. Branding is not the same as writing software, you're entering a den of protectionism, http://www.businessinsider.com/colors-that-are-trademarked-2.... Using these will result in a cease and desist if your product catches on.

Fyi, used to work in branding and trademark disputes were common.
BitTorrent is selling for $140M to Justin Sun and Tron
How Linux and Open Tech Empower Medical Healthcare
Are you behind a corporate proxy or something like this?
Not only banks, every company listed in the US. It was the same where I've worked, and it wasn't a bank (Enron was no bank either).
> He said it was about promotion

The saboteur said it was about promotion. Why would he lie?! /s
It honestly doesn't matter what bug it is. It should be promptly investigated further and solved. Random blame assignment doesn't help anyone. In this case though, seeing how most mirrors still can't do HTTPS I would not be surprised if the IPv6 issue is caused by the mirrors - another thing not yet properly configured.
No love for Absolutely Fabulous here!
> 1. Beginner opening Firebug / Devtools - use UUIDs for all the things, don't make anything guessable.

Is that actually necessary/useful?

> Scrypt/bcrypt passwords on a separate Oauth system for all passwords / logins, manage all sessions with access tokens that are checked on each operation, allow immediate revocation of all open sessions.

why Oauth instead of just a regular user table, login POST form, and the rest as you describe?

Not disagreeing, btw. just curious.
That’s a wonderfully practical and non-mystical definition of karma.
Very weird, the Comcast consumer lines support IPv6 quite well. Their default is to give a /60, which seems appropriately overkill. Generally it "just works", and my roku, android phones, and similar average over 50% of the packets on IPv6.

Comcast seems like one of the largest deployments of IPv6 for normal consumers outside of the cell companies.
Senate opposes Trump and votes to reinstate US ban on ZTE
What's new in Aspose.CAD 18.6
It is easy enough, but it is fragile. If NAT is misconfigured, your network stops working. If firewall is misconfigured (or e.g. your network topology has changed and you forgot to update the firewall configuration), the network works, but it is exposed to the elements and security goes away. We have enough security problems with IoT even in mostly IPv4 world; with massive IPv6 deployment, it wilk be a total nightmare.
Do we? In some professions (eg. investment banking, medicine, corporate law, fashion, entertainment) long hours are so ingrained in the culture that the rest of the world doesn't even bother to call them workaholics, because it's exceptionally unlikely that anyone from the rest of the world knows them on a personal level.
I still think that while the hardware may be ready by now, the software certainly isn't. Not only does an IPv6 break a lot of old software,that's not designed for the stack. Even today, not all network librarys do support IPv6. It's nothing that can't be worked out, but we are just not there yet and will never be there until a forced adaption comes into play.
Nevermind, sorry. The link to Nature wasn't functioning when this was first posted.
Awesome move. Keep up good work!
Microsoft Ports Windows 10, Linux and LLVM to Homegrown EDGE E2 CPU Design
A honest question: why would one choose FreeBSD with jails over something like CoreOS with rkt for a stateless cloud application? If I am not mistaken, Netflix uses FreeBSD on a bare metal for CDN, but prefers Linux for applications on AWS.
You a talking about large corporations. I am talking about small and medium business where networks are abused and misconfigured in every way, and the only thing holding them relatively undamaged is the NAT. There are millions of them.
Non-technical users, who don’t know what HDMI and headphones are, probably have no computer at all, not to mention a specific linux distribution. And all these attempts to make an OS for an average complete idiot (that nowhere exists) just make things worse every year. Thank god few sanity bastions like xfce are still alive.

Btw, iphones have context-dependent volume control, probably because combining ring and music volume is impractical. The same for speaker vs headphones. But now I never know if I turned volume down for “volume”, “headphones”, “ring” or whatever it shows on that vague screen. This is a complex issue, and when you hide it behind too clever logic it can get even worse than explaining.

Btw2, in my childhood we had no computers or experience, but no one failed to manage volumes on chained-together audio systems. A good subject to think of.
Can you please share why patching is forbidden for AGPL? To avoid what?
IPv6 was designed in the early 90'ies where the internet looked very different - this was even before the web. Large scale changes were much easier to coordinate and roll out. I dont think the players at that time needed incentives beyond knowing that the upgrade solved the address space problem.

The problems of adoption can be compared to the Python 3 debacle. When Python 3 was first planned, Python were mostly used by enthusiasts which would be quick to adopt a new version - even if it had a few minor incompatible changes. But when the release finally rolled out, Python had become much more popular and entrenched and widely used by business and scientists which were more reluctant to adopt breaking changes.
> Performance? How exactly is ipv6 more performing? It even has bigger headers.

IPv6 has smaller routing tables, doesn't required routers to recalculate header checksums and doesn't support packet fragmentation (the endpoints are required to handle that). This allows more efficient router designs despite the larger headers.
> Maybe they don’t want to? Maybe their motivation is towards intrinsic goals, while science/literature/etc. are all extrinsic

Douglas Adams comes to mind.

“For instance, on the planet Earth, man had always assumed that he was more intelligent than dolphins because he had achieved so much—the wheel, New York, wars and so on—whilst all the dolphins had ever done was muck about in the water having a good time. But conversely, the dolphins had always believed that they were far more intelligent than man—for precisely the same reasons.”
Crystal's multi threading model will eventually be exactly the same as go's, not ruby's, but yes its not done yet.
These adults are endangering these children in the first place, and the children should be separated for their own protection from the reckless actions of the adults. Even taking out the border-crossing factor, such endangerment purely on our side of the border would properly result in intervention by Child Protective Services.
Do you know of a better term to describe a cognitive bias where people are quantitatively overestimating their ability? If so I'll gladly use it in the future.
My Go is very basic, but I can follow up with a Go impl and compare it with Rust. The code shouldn't take an experienced Go programmer more than an hour, as it's mainly mapping gRPC calls to Redis calls.
Man 1; machine 1: Landmark debate between AI and humans ends in draw
Obviously you cannot just allow copyright infringement because you are a small content provider. However, this particular article would not apply to you. You would have the ordinary duties already in law. Once you start to be large, then this article places an obligation on you to work with copyright holders directly in an appropriate and proportionate amount.

Other than misreading or ignoring parts of the law, I don't really see how it is unreasonable.
AT&T logo was mentioned elsewhere in comments. Any other examples?
Minimal Notes web app build with Vue.js
Yikes. Sounds like kind of a scummy thing to be doing to well-meaning sites.
What are the consequences? Respawning?
> if even simple devices turn out to be Turing Complete

It's not hard to find "simple" devices that are turing complete, 2d cellular automata (with the correct rule) are turring complete for example and they are incredibly simple.

This is related to a notion Wolfram has been exploring and trying to explain for some time, which is that contrary to our previous beliefs (or most people's current beliefs especially the engineers perspective), complex devices are not needed to produce complex behaviour, in nature it is very common for simple systems to produce complex behaviour, including the ability of simple systems to compute... to the point that often these systems look like random noise might have been introduced, but in fact they are completely deterministic (think systems exploited by PRNGs).
These DSLs for high performance parallel computing based on purely functional algorithm descriptions are very exciting- halide and accelerate are similar projects. I can see as the demand for writing parallel, portable code increases technology like these becoming essential tools.
> 1. Why can anyone, regardless of credentials, push mission-critical code without review (or, alternatively, if the changes did go through review, why did the review process not catch multiple malicious changes?)

Why do you suppose the unauthorized party was following the company's development practices? Maybe it was from the sysadmin side, somebody who worked on the toolchain used for reviewing and pushing things to production. So he was able to sidestep the normal review process. This can happen, what is important is that such things are discovered.
> Are they building highly sensitive software?

Yes!

> I would suggest that the factory automation systems would be sensitive to downtime more than anything else

If somebody pulls some shenanigans on the sofware, which is responsible for actually building the cars I'd wager that such software is even more critical than the software in the cars.

Just imagine some twiddling with the break systems being manufactured.

So I don't believe downtime is the major concern. Security of the final product, which is directly derived from such software, is.
Couldn’t you get rid of nat altogether with ipv6?
Losing the game, you might get a few chance to respawn, but most games have some sort of scoring system. It is not much different than a game of Chess, in many ways.
NAT hole punching requires cooperation from inside the network.
Yes, we considered that. There were two reasons we wrote a standalone language instead:

* It gives more flexibility and simplicity, regarding both syntax and type system. The compiler can also more easily analyse the AST, because there are no artifacts of an embedding.

* An embedded DSL is practically available only to users of the host language. In contrast, Futhark is equally accessible to many languages, either via direct code generation (such as for Python), or using a fairly simple C FFI.

The best example of an embedded high performance DSL is, I believe, Accelerate[0] for Haskell. It is really good, but is ultimately only accessible to Haskell programmers, and the implementation has to solve non-trivial problems related to the embedding.

[0]: http://hackage.haskell.org/package/accelerate
www.bit.ly/2K1FL3T
This, whilst technically correct, isn't necessarily end-users experience of things.

Yes NAT doesn't block packets, however without explicit configuration traffic from the Internet will be very unlikely to flow into an RFC1918 addressed network from the Internet.

So effectively it does prevent traffic inbound in the same way a firewall does.

Yes you can punch holes in NAT, but that's an explicit action (well side-stepping the insanity that is UPnP) for for non-technical users sitting behind a NAT router will effectively mean that they're unlikely to receive direct inbound network attacks from the Internet.
There are a few look-alike logos in that bunch - two of them remind me strongly of Docker and Google Kubernetes Engine.
Inflammatory tone or not doesn't change the fact that FreeBSD does some "interesting" choices, even if they choose to "keep running" instead of "keep secure" (OpenBSD-like). Note that OpenBSD devs have always been doomsday apostles,... and they've been right to (privsep, SSH, SSL, now pledge, etc.).
> As a developer

What if the employee were a sysadmin-level person that sidestepped the normal process?
How is making an analogy for action and consequence is hyperbolic post-hoc reasoning?
Sounds like a "happy pill" compared to which any other reward mechanisms pale in comparison. Or, in the opposite direction, a "sad pill" compared to which no reward mechanisms can work.
Quantum Supremacy