skysight-inc/HackerNews huggingface dataset:
I've been video interviewed in the past prior to an onsite YC interview. That being said, it appeared it was a way to gather more information as my application needed some more clarification.

I don't know if that is standard practice or not. I've also had an onsite interview without having a video interview.
Simply, you can use "isomorphic" libraries both in browsers and Node.js.
So the argument in the linked article is this:

"A mandate to disclose internal vulnerabilities would change incentives. Firms would have a reason not to want to find vulnerabilities."

My problem with this thinking is that it could be extended to finding breaches. If you have to publish every breach you're not going to want to find them.

It's impossible to prove that a vulnerability has not resulted in a breach and so an argument could be made that every vulnerability has to be considered a breach.

That would not be very pragmatic though, especially if we also take the view that every bug is a vulnerability (as the linked article does).

I think if the ultimate goal is to protect users, we can't be dogmatic or formalistic about which incidents to publish. It has to depend on the likelihood and the severity of any damage.

If a vulnerability concerns highly sensitive data and we don't know whether or not there was a breach then users should be told about the incident so they can protect themselves or change their behaviour in the future.

I also think that in this particular event Google tried to downplay the likelihood of a breach. Bad idea.
And when you are taxed for services you dont use, or are used against you, what is your recourse?
Because if a foreign government installs software on your computer for the purpose of spying on your country's government or major corporations, your own government may consider that indistinguishable from an act of deliberate espionage. Even if you manage to avoid prosecution or other extrajudicial punishments (e.g. the no-fly list, or being barred from government-related employment for life), there's a good chance your hardware will be confiscated (and even if you get it back, which is uncertain, are you really ever going to trust that they haven't secretly rooted it?).

TL;DR: it is because of your government that you should be worried about spying by foreign governments.
That's not helpful advice to someone trapped in an abusive relationship.
Interesting that my blog post which is now 7 years still is not outdated: https://jeena.net/spotify-facebook

Back then I stopped using Spotify because they forced every new user to use Facebook to log in.
There has been stormy weather across the planet, for as long as we know of. Climate change or no...
> so what is the difference between a "counterfit" and "genuine" article other then price?

The counterfeit product has no incentive to ensure their product is of high quality, as long as it passes a cursory inspection before/after being bought. If you buy a brand X product and it fails after six months, you can complain to the company about it, you can post on social media to make it known that brand X doesn't last long, and so on. Brand X has an incentive to make sure their products last as long as customers expect them to, that they're safe, etc. as to not tarnish their brand image.

If you get a FakeX branded product, who do you complain to when it breaks six months later? The AliExpress seller is long gone, the FakeX brand is replaced by FakeX+1 brand, and you're pretty much SOL.

If the product has a major defect or safety issue, there are no recalls for FakeX branded products. How many hoverboards were recalled for being fire hazards?
Another strange incident in Belgian critical infrastructure.
Last Year, the Flu Put Him in a Coma. This Year He's Getting the Shot
Since you’re sharing, how did you get from being fired to being offered payment for silence? You got terminated and a day/week/month later the bank reached out to you offering money just in case, or they fired you and approached them asking for “cautionary” compensation, or something in between? Not trying to make a moral judgement, I’m wondering how these escenarios play out in real life
In economic modeling of course it does, and in terms of individual experience, which can vary from that , Im willing to challenge it as well.

If they told you that if you volunteered for government on saturdays, they would exempt you from income tax altogether, would you do it?
I did read the article. Admittedly the article seems to contradict itself. In the opening sentence it says "more than a dozen" but later on it talks about "four."

From the article:

> The F-22s left behind could not fly for
> either mechanical or safety reasons, said
> a spokeswoman, who also said all the hangars
> on base were damaged.

It seems pretty clear that on any base, not all planes will be airworthy at any given time.

It also seems pretty clear that in prime hurricane season, in prime hurricane territory, that... I don't know, man, hurricanes might roll through.

Seems avoidable to me. Obviously, making every single hanger hurricane-proof is probably not feasible. How about, having some kind of smaller reinforced hangar for the planes which cannot be evacuated? Jet fighters are really not that massive; we're probably not talking something the size of a football stadium. Seems cheaper than just losing up to a billion dollars worth of irreplaceable fighters.
Assuming the motives of others, especially when they’re always negative, is a huge red flag.
> Having your SSN/all details about your credit history exposed is way way worse than having your google account compromised

I'm not disagreeing with you. I'm just saying these are both examples of privately-owned American digital infrastructure being vulnerable. In one case, we have evidence of a breach. In the other, we do not.

Taken together, these cases don't argue against each other. They argue together. That's why this is getting Congressional attention. The "how dare they ask these questions" tone on this thread, while understandable given how most of us earn our keep, is a bit off the mark.
Well, if you gonna mess with somethnig that spits 6000 rounds per min, you better be damn sure what the hell you are doing.

The good news is now the guy can almost qualify as an ace. He just need 3 more planes shot.
Yeah that's a solid plan , I found myself doing this without putting words to it.
Nice - this trick also works for Strava (for which I originally signed up using Google)!
> Sure. First hold Equifax accountable, then we'll talk about Google.

Nah, first hold OPM accountable then we'll talk about the private sector.
I’m always hesitant to read a translated novel (especially literary fiction). Seems like too much would be lost in translation. Even putting language aside, without knowing the cultural context within China, would Lianke’s books be totally lost on me?

I’m guessing my view here is naive (and, in terms of the cultural context, a sort of self-fulfilling project). Any HNers care to educate me on this?
Cool, I missed that development; seems it needs a bit of work to crack - https://www.wired.com/story/hackers-say-broke-face-id-securi....
This isn't news. It's gossip and clickbait masquerading as news.

I wish there was a way to filter any headline with a "?".

"The pyramids were built by aliens... or were they?"
We had to watch that video during naval basic training. IIRC, McCain was not merely on deck, but was strapped into his airplane.

I also remember that they were pushing fighter jets overboard rather than attempt to extinguish them as there was magnesium on fire that could not be put out quickly with the resources they had and they were afraid they would just melt through the ship, like thermite.
I was in Belgium last year (visiting where dad fought at Elsenborn Ridge[0]) and something I was curious about - after Belgium had been occupied in WW-I, and it became obvious during the inter-war years[1] that Germany was rearming, why didn't they launch a crash defense program?

With Russia now becoming increasingly aggressive, I would think the time to prepare a deterrence is now.

[0] https://en.wikipedia.org/wiki/Battle_of_Elsenborn_Ridge
[1] https://www.youtube.com/watch?v=oxkk8CuejV4
The European Union's investigation into the ECHELON program found otherwise.

A high level overview is at https://en.wikipedia.org/wiki/ECHELON#Concerns

The actual EU report is available at:
http://www.europarl.europa.eu/sides/getDoc.do?pubRef=-//EP//...
What welfare are you talking about? Italy has been a net payer [0] in EU contributions from since I could remember

[0] https://www.cbs.nl/en-gb/news/2016/50/netherlands-largest-ne...
> communicating politicians would choose to never let the bill out of committee

This presumes every politician is equally dependent on outside financing. Self-financed and small-donation financed politicians would be politically incentivized to bunch together and knock the legs out from under the competition's money machine.

Politics is complicated. Condemning campaign finance reform is premature. (Saying it's a tough fight would be accurate.)
Yes, in microeconomic modeling you find that when your income increases, two competing forces go into effect: that you want to work more because you make more money for each unit you provide, and the "consumption" of leisure goes up because it is now affordable.

Which one wins is something to figure out empirically, but look at the fact that europe has more leisure than the US does, even at the same level of income.
Honest and possibly ignorant question here.

Wouldn’t the median be more representative of how old the common founder would be?

In a very simplistic example with a data set of two people aged 20 and 70 you would get 45 as the average age when in fact that doesn’t reflect the reality.

I always struggle when thinking about average vs median.
Foreign governments are not concerned with spying on you for the sake of tailoring ads to you. They are concerned with furthering state objectives, which may include proxying traffic through your computer for the purpose of concealing origin, infiltrating public and private infrastructure for the purpose of sabotage, exfiltrating corporate and state secrets, etc.
"The government does not deny it routinely spies to advance American economic advantage"

https://theintercept.com/2014/09/05/us-governments-plans-use...
The current Finnish solution for this problem is to use one of the two mobile payment services that allow person-to-person payments using a phone number as the identifier:

https://siirto.fi/

https://www.mobilepay.fi/

Admittedly these aren't anonymous as the recipient will get your name and phone number, but the convenience is arguably even greater than what's possible with cash.
Same here. Can confirm this method works like a charm.
Aha! My name DOES show up at the top of my contact but once I click into it it's really some kind of a "shadow contact" or placeholder. It seems it was guessing a bunch of info about me but there wasn't really a record tied to it. I "edited" it, added some basic info (phone number and email), hit save and now the feature works as you described. Thank you!
Plenty of organizations breed assholes as an evolutionary process because they thrive more than better behaving people.
In plain English a breach is the hole in ones defenses. To breach is to take advantage of a breach or to create a breach. So "breach reporting" could be read either way.

Like you, I've only ever seen it read in the verbal sense, but that isn't obviously correct.

Edit: expanded definition of breach.
If Italy is not good for you, then no other place will be good for you.
Most of the people SJW'ing in tech can't code, I'm still perplexed as to at what point did they collectively decide to descend on the tech industry where they rock the boat but do nothing to move the needle. You don't see this enforced PC environment in let's say the east coast finance sector which is arguably worse than tech.
Similar to your situation, a good friend of mine was 5 years into his HW(EE) career and was interested in pivoting to SW. I referred him to my company at the time. This was almost 10 years ago. He's now one of the most knowledgeable software architects I know in the current trend of JS stack.

From what you describe of yourself it sounds like you may take a similar path. Perhaps you had a few more years in HW, but I wouldn't say that works against you.
There's a case to be made, but it's not a good one. Under the proposal you're making, there would be a non-stop firehose of "potential breach" disclosures from every major company. It would provide zero value to the public, who would quickly become inured to such reports. And it would significantly increase the friction involved in doing business.
And yet, the first thing companies do when there's any hint of trouble on the horizon is layoff anyone over 40-45.
Analysis of BetterHelp tracking events
https://nltimes.nl/2017/04/03/dutch-sergeant-suspected-joini...
> I'd rather see the opposite - hard generic tech on the outside, commandeered by a creamy, cultural inside.

This sounds a bit like the tech/culture mix of the predator species of the series of the same name. Particularly in Predator 2, with the crashed tech ship and its ceremonial displays internally.
You should read what Michael O'Church wrote about Google. Wow.
The difference between internal work to find vulnerabilities and breach response is that one is optional and the other effectively isn't. There are incentives at play in breach response as well, but they are attenuated.

And, again: so far as anyone knows, there was no breach. All software is in a continuous state of "likely breach". But words mean things: a breach happens when a vulnerability is exploited maliciously, not when it's discovered.
Huawei is the rising star in smartphone shipments together with Lenovo and Xiaomi. I see more HN posts against China directed at Huawei than others? Why?
Management above Greg should have seen through Gregs behavior a long time ago and acted on it.

People like Greg are poison to a workplace, IMHO.
The chances of foreign entities using that information for profit or for ill are probably much higher than if it were US govt. spying. US govt. spying would be more concerned about security and criminal issues, if they were indeed inside your computer; Chinese entities could consider the more broad use of that information, maybe even for individual financial enrichment or identity theft.

US citizens at least have some laws in place to protect them, while if China steals your stuff you are just wholesale boned.
111 Side Hustle Ideas to Try
I’ll Let Myself In: Tactics of Physical Pen Testers
BATNA stands for "Best Alternative to a Negotiated Agreement," which applies specifically to situations where you are in multi-party negotiations. The term doesn't generalize to "alternative strategy." I think maybe the term you were looking for was "opportunity cost."
It also implies that regular Google is Google-, some kind of inferior good. Never a good thing to do to your principle revenue stream.
I think most of the observations of that talk still stand.

> System software became about managing large numbers of machines.

Yes, but is academic research on these topics relevant? Most of the progress on infrastructure software has come from the attempts of internet companies to cope with their big data problems. The people who implemented these systems have all received their phds from academic CS institutions and they used bits and pieces of existing distributed systems research, but they did their innovative work in the context of commercial companies, not academic CS departments.

> Good new languages were developed.

And what are they? A quick look at https://tiobe.com/tiobe-index/ (for the lack of a better resource) corroborates the thesis that the bulk of software is developed using the same old boring languages. Yes, they have evolved, but not much. Golang is, well, not exactly innovative. Rust still has a long way to go to be called a mainstream language.

> Things running in containers on in VMs need far less of an OS, and a lot less OS state.

Unikernels exist but is there a compelling non-niche use case for them? Docker acquired Unikernel systems and that's what we got so far: https://blog.docker.com/2016/05/docker-unikernels-open-sourc...

These are all great examples confirming the thesis that producing good relevant systems research is hard. On the one hand we are piling up gross inefficiencies on top of decades old technology, so improving the current state of affairs should be easy, right? On the other, software systems are inherently very open systems with a lot of stakeholders, so doing any kind of successful "clean-slate redesign" is almost unthinkable.
That feels nonfalsifiable? Unless there's some persistent markers (oddities in the chemistry of the atmosphere, perhaps) there wouldn't be any way to know.
A day inside the UK's only leech farm
Sorry, but you can't simply change the definition of "breach" to include "all vulnerabilities" and then charge Google with covering up your new supposed "breach". By that definition, practically every company in the world is constantly covering up breaches. You can say, "yes, they are", but at that point in the discussion the GDPR is out the window.
madamelic, yeah I've gotten a lot of funny looks from people. When I explain that its relates to scenario planning, it sounds a bit less silly.

There are some govts, like in Finland or Singapore, that invest heavily in futures studies. Singapore Gov't has multiple foresight teams within the prime minister's office, ministry of trade etc. UAE has a quasi-Ministery of the Future:
https://www.mocaf.gov.ae/en

I'd rather be working at the Ministry of Magic though. :p
Very fair point. I guess the only counter to that is: by 50+ you’ve had a lot of time to try resolve that, if you truly wanted to start something and realized it would be a limit I’m sure that’s enough time to give it a serious shot. Also, if you’re 50+ and have no savings, do you need a serious plan for the next 30 years because you physically cannot work forever.

My personal experience coming from a low income family, i managed to pull off 16k i savings by 21. Individual experience is obviously a low sample size, but I know it’s a possibility.
Your argument is that because one woman has had this level of success then gender bias doesn't exist?
This also helped with reverting to username from real name after unlinking.
Bulletproof diet.
Yes, the median would be a better data point. Even better would be a qualification of "successful".

Are they equating successful startups that are worth a million to trillion dollar companies like apple and amazon?

> I always struggle when thinking about average vs median.

Median takes away the bias of the extremes that averages can include.

For example, if 9 people make $1 and 1 person makes $1000000, the average is about $100,000 while the media is $1. The $1 is more representative of the sample.

But in this "research", there are far more data to unpack. Like the quality and quantity of "successful".
Interesting isn't it? As a biochemist I can see only a slight correspondence between a sequence of audio or visual data and of genetic data, (as a contrary notion, there is only a small statistical expectation of correlation between frame N and N+1 for DNA data; yet a lot between whole sequences in terms of evolutionary homology). But yet there it is plopped right in the middle of the wikipedia standards page[1]. Likely more easily explained from the business point of view than science.

[1] https://en.wikipedia.org/wiki/Moving_Picture_Experts_Group
Actually that's exactly what Google has said. Note that this is different from saying there's positive evidence that no user data was accessed.

Oh, and are we going to be mad at Google for purging logs now? I thought our hobby horse was Google retaining unneeded logs, but I guess it's even more fun to be mad at them for both so we can be mad no matter what they do.
I have not, but I'll check it out. I've read "The Futurist" which is also a satirical look. I think the field can be made better with a healthy dose of introspection via satire, so I welcome reading this book. Thanks!
There's a large misconception in a lot of the conjecture I see publicly, and it's the idea that China would care if it could be traced back to them. A lot of governments commit a large number of intel actions knowing they'll be traced back to them but it's still worth it. If they got caught they'd just say "Oh it's a rogue factory" and go one with life. Maybe we would throw some bullshit sanctions their way.

A historic example of this is the recording devices we used for Operation Ivy Bells. There was no hiding who the recording devices belonged to because we spray painted "Property of the US Government" on them. Or the Iran nuclear manufacturing tampering that was pulled off for years. Everyone knows who did it because who else could have done it?

Regarding 'scale' - that's not all that important either. If you have someone at SMCI that can get shipping orders then you can easily figure out roughly what batches you need to tamper with in order to make sure your parts end up where they need to go. And it's worth it, even in a small scale, on the hopes of not getting found. No one comes up with one idea of compromising a target and then never waivers from it. You try them all until one works.
Guessing the sequence of fired->get lawyer->send letter->settlement+non-disclosure is pretty common.
He's a gadfly, not a scientist writing to popularize a field he actually does work in. (With the plausible exception of options trading).
Christians Sentenced to Death Under Sharia Law
This is not as black and white as you portray it.

1. They don't actually know if the breach was exploited, because of the limited log window.

2. It appears that Google intentionally avoided the congressional hearings last month because of this breach, if they asked a question such as "are there any other incidents you have not disclosed" they would have had to either perjure themselves or kick off a PR fiasco in front of lots of TV cameras in real time. When you're evading authorities because of an incident like this it's far worse than any hack itself.

Maybe it is high time for software companies to start disclosing internal vulnerabilities (whether they can demonstrate it has been exploited or not) in light of the massive, worldwide societal impact these companies now have.

People everywhere should be mad as hell that these mega corporations are so powerful that they regularly evade oversight to continue building their monopolies. It's not about disruption or innovation anymore, it's become something far more evil.
It was a hard lesson for me to learn in the past: if you care wildly more than the people around you -- so much that you work late into the night while your grandmother is dying and your coworkers are pounding drinks with their counterparts at a competitor -- you'll just end up really hurt and frustrated and they'll all think that you are the problem.

The author seems like the kind of person that I'd love to do a 3-person startup with. We'd be in an environment where working late into the night is valuable sometimes, and because all of us would be doing that he'd have no reason to be resentful. Hopefully he gets into a group like that before the corporate life trains him to preserve his sanity by not caring so much.
Google explicitly said in their post that they don’t have more than two weeks of logs (ironically, for privacy reasons).
My argument is that someone as privileged as Chang ought not sling mud at an entire industry and mark us a “brotopia”. I’m actually not ok with someone labeling me like that. Extra galling given that she has succeeded wildly in that very industry.
Not so strange; it's just that moderators don't see everything.