skysight-inc/HackerNews huggingface dataset:
This is similar to Katie Moussouris's argument from the article:

> Moussouris, who created the bug bounty at Microsoft, warned that if badly implemented such programmes could see talent leaving organisations in favour of pursuing bug bounties, and thus damage the talent pipeline.

I've seen her argue this on Twitter before - the argument IIRC is that bug bounties should always pay less than getting a job helping the blue team / writing secure code in the first place, otherwise the incentives are all wrong. It's great that you know about bugs, but it would be better not to have them. And, also, there's a bit of a prisoner's dilemma involved in that you don't want to let the rest of the industry drive up the expected payouts of bug bounties beyond the expected salaries of secure developers, but you also don't want to lose out on vulnerability reports either.
I read this article. It’s certainly possible. Did Michael/Omar travel to India with Cotten on the trip that Cotten died?
Warner wouldn't do. Search @straczynski pesting about Warner and B5.
For chess the are no men's only tournaments (on a professional level) but there are women's only.
Mx Armamut is perhaps not a native English speaker. Let us suppose that the first part of the sentence is a statement, and the second part is the rationale - then, by way of conjunction, a native speaker would probably choose something like "because", or similar.

I expect there are languages where a word that translates neatly into "while" would be most appropriate, while actually meaning something more like "because". It's been a while since the last time I had to speak any foreign, but I remember stuff like this being very common - a large part of the reason I refuse to do it any more.
Setting aside for a moment the fact that your financial history includes your home loan which includes your home as collateral which is located in your zipcode, suppose that the model got more accuracy by looking at the zipcode. Isn't that all the defense that's needed? What is meant, exactly, by "defense?"
Choosing a new team within Amazon
I am probably alone in this, but...

Yes, I lost $15,000 — but if you’re going to lose money on a budgeted, high risk investment, it’s great to do so embroiled in the strangest of human/technical dramas. I am loving it.
Creating IoT Applications with Azure Database for Postgres
Stop Following SecretFlying
If you really wanted to, you can program in a subset of C# that is similar to C. You can avoid the garbage collector by using a native memory allocator and then manipulate pointers with the usual * and -> operators.

While you probably don't want to write a whole program like that, sometimes it is helpful to use these features when porting code from C or for performance reasons. See for example this implementation of memmove that is used for copying strings and other things:

https://github.com/dotnet/coreclr/blob/7ddd038a33977b152e856...
I drove alongside Larry Page on 101. He was in a Nissan sedan, maybe $30K. This was two years after IPO.
I’m a little deeper in the funnel, but I prefer narratives over lists of acronyms. Give me something to talk about.

Also, are people seeing your resume, or is some middleman changing it? I notice with Indian candidates agencies tweak them in ways or for reasons that often don’t benefit the candidate.
My "understanding" of category theory is extremely shallow, but that's exactly why I think my proposal makes sense. It is the kind of thing that everybody ignores for decades precisely because it's transparently obvious, like a fish that doesn't understand water.

Here is the statement:

The meaning of no category is every category.

reference: https://terrytao.wordpress.com/2008/02/05/the-blue-eyed-isla...

This was already understood by everybody in the field, no doubt. It's just that somebody has to actually say it to someone else in order for the symmetry to break. The link above has the exact description of this, from Terence Tao.
The domain lookup info is silly, but if you lookup your smtp server IP it’ll show you a score that in my experience is correlated to the probability of it not being in a blacklist.
but we're already removing apps we deem against our morals.
Bitcoin is not an exchange. That's like saying the economy is screwed up because a company went bankrupt.
JetBrains MPS is such an example: https://www.jetbrains.com/mps/
Whoa I didn’t catch this. Thanks for posting it.
In The Big Short you read about how the guy in the baseball cap and jeans is probably a fund manager doing really well. The guy in the suit is about to go ask for more money because he's not doing so hot.

It's the same principle in Silicon Valley.

The status symbol is being enough of a hot shot to not have to play by the rules of status.
The transactions are recorded on the blockchain. However, like USD money laundering, there are techniques for concealing the overall cash flow in order to make forensic analysis difficult. Also, once coins have been deposited on an exchange, there's no way to know (without the exchange's assistance) what account on the exchange those coins were assigned to, and whether or not that account sold the coins and cashed out.
This way of writing (like a journalist) is so annoying. I prefer much the scientific style of writing where the main idea is given in the first sentence, and suspense is avoided as much as possible.
Scientists Create ‘Artificial Life’ on a Quantum Computer
A notable reason for this sort of thing happening is that the price increased. Solutions which are obviously just toys very quickly grow into problems without you having to do anything.
> the browser would still have to download each dependency before they can resolve their transitive dependencies.

The endgame of that train of thought is something like https://mariusgundersen.net/module-pusher/
Honestly, I'd much prefer if you tell me if you're familiar with the problem.

I previously interviewed at a company and of the three interviews, I knew, and informed them that I knew, 2 of the problems they asked. I solved all 3 and got the job, likely because after I implemented an lru cache in ~10 mins on a whiteboard, we turned around and I actually coded it up in an ide, added tests, and then we had some extra time to fix a few small bugs and discuss caching strategies.

I'm still torn on the value of that interview though. And I'd much prefer to ask you a question you don't know than to have you write down a rote memorized answer, or pretend to be uncertain. I can usually tell and it wastes both of our time.
The coins themselves can be tracked on the blockchain, but once they're deposited on an exchange, the coins join a general pool and accounting external to the blockchain (such as what account on the exchange was credited for a coin's deposit, whether or not the coins were sold, and what amount of cash was withdrawn) becomes relevant.
I just added typescript support. Check it out!
If he'd posted an executable, unless it was for exactly your platform, wouldn't you just have complained you didn't currently have a machine running the correct operating system on the correct hardware?
I’m a big fan of Io, but, sadly, it is no longer maintained. I’ve toyed around with writing a more minimalistic implementation suitable for lua-style embedding, but have never found the willpower to finish it.
I ran into exactly one company that attempted to get me to do a take-home; they were gibbering idiots, statistical imbeciles, and their company proved it in the 5-6 years since then. They're still around: a clown car run by frauds and mountebanks, powered by gas, hype and free labor.

The right way to do a take home exam if you must do this: give them something real and pay them consulting rates for it. If the result is good, you've hired a great worker. If the result is bad, you will know, they'll get a few bucks for their time, and no hard feelings. If you can't screen them to the point where you you can't screen for decent odds on a take home, you should consider a new career. Maybe picking potatoes.
The funny thing is that he talks about how Zuckerberg probably sees himself as the emancipator. This is true for a hell of a lot of us, even those of us who haven't made it yet.

It's true. But there's a slight difference. No one has faith in the government. There are only those who are see themselves as powerless in the face of this and those who see themselves as the agents of change. The Messiahs have been commoditized.
So, do you format back again to your style before editing?

You can't preview a file without modifying the file.
Thanks, TIL. But 8 was common, right? At least from online sources I was under the impression that typewriter tabstops were the reason for the 8 character default.
Nice one! I might say hideAllExcept(/(C#|\.NET)/i); although I'm sure that'll pull in a few false-positives...
Amazon's Letter to Shareholders, "one way doors".
Many of the Oracle system I worked on were huge. Hundreds or thousands of stored procedures that would have to be completely rewritten. Migrating the data...that is easy. Staring down a 10,000 line stored procedure is daunting.
I don't know about this. I'm on board with not using race as a covariate -- people are born with their skin color and to penalize someone's loan application over something they're born with and have no control over is unfair.

But zip code? I understand there is empirical data showing how race is correlated with zip code, but you still choose your zipcode at the end of the day. If you have data saying that applicants from "Zipcode X" are less likely to repay loans, why is one's choice of zipcode out-of-bounds but their choice to have a hard credit check several months ago not? What if a poor credit history is correlated with race (fwiw I don't know if it is or not)? Is it then discriminatory to use credit history as a covariate?

The truth is that machine learning to predict people's behavior is inherently discriminatory and involves generalizations by definition. Once you start disallowing training on covariates that exist due to voluntary behavior, it's not really clear whether you should be allowed to use machine learning to predict individual behavior at all (I'd probably listen to that argument actually).

There's clearly a tradeoff to be made in terms of how much discrimination is allowable in exchange for a given unit of predictive performance, but that sounds incredibly difficult to regulate for every business's ML problem. I don't know what the answer is, but I think it's hasty to argue that anything that's correlated with race is out-of-bounds.
Just like JS clears CPU memory, webgl clears GPU memory before access.
"An environment that needs to work" is not what "production environment" means.
Emojicode I thought I'd seen it all...
If you'd like I can whip up a GUI interface in Visual Basic. You can use that to track an IP address.
Security problems are bugs but not all bugs are security problems.
I'm not a security expert by any means, but based on learning other niche-ish areas of technology, the following probably exist for security:

* Books

* MOOCs

* Lecture notes, slides, and assignments from university courses

* Subreddits, Quora topics, etc

* Prominent community members you can follow on Twitter
There's stages.

I get a lot of work done at a white hard with 1-3 coworkers. We reach a consensus there, and then you formalize and write up the design and break out lucidchart or whatever.

It's not worth spending time making a design when you're going to forget something important and have to rework it. Use a whiteboard until you're confident you aren't going to erase again, that's my rule.
gdpr really only cares about personally identifiable information, afaik. You don't need consent for anonymized stats.
Buffett doesn't know where the cloud is going? That admission just shows that Buffett still seeks to understand the boundaries of his competency. Classic Buffett.

Also, I like that he's buying Red Hat. (He won't hold it long, though. IBM is getting closer.)
Pro tip if you are a startup and want free security advice. Just sign up for all the bounty sites and for every single bounty just tell the submitter that it is a duplicate bug and pay them nothing, then hot patch it immediately and when they get suspicious tell them that their bug report had absolutely nothing to do with the timing of your patch. I know there are companies that do this because I have had it happen twice. There needs to be a bug bounty site with some sort of bug escrow to prevent this behavior.

Edit: pardon the tone, I understand that these types of problems are very very hard to solve because they aren't purely technical and involve humans.
> So much diagrams with made up data. It's like ... it's OK to make up things just because it not falsifiable. Who could have thought?

That's a bit of a strange criticism. The diagrams are meant to be illustrate a point, not precisely quantify data.
Nasa speeds up its interplanetary communications
Gotcha. At that level I guess your only options are Assembly, C, or FORTH.
You should provide a way for people to contact you
Relevant: https://qz.com/369338/this-is-what-makes-dressing-down-a-sta...
I don't think anyone is saying it's OK. Just that removing the app will have 0 effect on the current law or the outcome. They'd just go back to pen/paper like they had to before the app was available, and take longer.
This is 1MM over 3-4 years, right? $330k is good money, but it's also in the ballpark for gifted vulnerability researchers in SFBA.
>Enterprise customers. That’s a nice way of saying well-known brands who spend a lot of money on each other every year

i'm definitely going to be stealing that line
And the Earth ships then turn around and flee lol
Apart from the standard methods mentioned by other commenters, you can also play CTFs (and read past CTF writeups). The problems in CTFs are not necessarily reflective of the vulnerabilities in modern software, but it's a fun way to learn a lot of the tools and mindset involved in real security research.
Yes! The delivery of that line is just too good.
Yes there are several such projects underway:

1) https://www.reddit.com/r/BitcoinCA/comments/avzh7s/community...

2) https://www.reddit.com/r/BitcoinCA/comments/ar86lf/report_sh...
Steve Jobs had his famous license plate-less Mercedes. While that man is praised for too many things, perhaps he deserves credit for not pretending to not presume himself to be above you or me, unlike so many of his successors today. An honest sort of arrogance.
> The status symbol is being enough of a hot shot to not have to play by the rules of status.

I definitely feel bad when I hear stories about black and hispanic men having to dress up at work because people feel scared of them when they wear hoodies and torn shorts like I do.
I don't doubt your lived experience, but for real companies, the economics of ruthlessly withdrawing bounties don't make sense; bounties just don't cost enough money to be worth picking fights over.

There are some patterns where I've seen people not get paid just on general principle; for instance, people find systemic issues and, rather than disclosing the root cause, try to claim bounties for every instance of the flaw (you'll get paid, but not for every instance). It's possible that naive development teams sometimes get this confused, and, for example, consider "all XSS" to be a single systemic bug.
The author takes this into consideration:

* yes, I know ‘low-level’ is a subjective term

I used to work in the embedded world, and there C has historically been considered a "high-level" language for many platforms. However, we have started to see languages like C# and Python make their way into the world of tiny micros thanks to more power coming to the platforms themselves and the clever work being done by MicroPython and Microsoft.
This is a English speaking forum, so news in other languages are usually ignorer or killed, unless it's extremely interesting, it's the original source and there is no equivalent in English. Does this have some information about the startup scene in Germany?

At least translate the title in the HN submission and link to a version with the title of the post in English.
If I had to rank them, I think Iceland is the most tolerant country. Assuming you know how to use the Icelandic-correct way to use Sauna and the Hot tub. Generally speaking I think smaller countries are better for this; dissent becomes a judgement on a personal level which is almost always more generous than on a societal level. In Iceland I heard many times, "I knew Bobby Fischer, he was a nice man." In America we still think of him as some kind of demon because ... I dunno, he said things I guess. Reality was he didn't bother anyone which is more than you can say for virtually any US politicians.

Personally I don't look at things this "what is most tolerant" way. You don't pick the country which is tolerant and accepting of dissent: this is a futile exercise. You pick the country which best fits your views.
It's always good to live beneath your means. Not just for financial reasons, but because you'll be happier if you do.
On a completely unrelated note, I like the app's logo, it's a reduction of the app's Arabic name. It would normally look like this: أبشر
Why would you give credit for that? It's not something to be emulated.
Quickly perusing the code, it looks entirely luigi based.
"Slippery slope fallacy" defined. Simply agreeing to outlaw some things — child pornography, incitement to murder, violation of human rights — doesn't set you on an irreversible course to outlawing everything. Partial regulation by community consensus is a fundamental tenet of all human civilisation.
Google siding with Israel is not surprising.
Cool.

The author chose to write a first person narrative on their personal blog. What you prefer doesn’t really matter, except in so far as you can choose not read the piece.
In addition to other methods, never underestimate the importance of breaking stuff for yourself. Teenagers are often very good at this (partly because they have the free time and they don't care about the consequences).

Beside that lower level knowledge of how computer systems work is always worth studying up on.
> The root of injustice is simply bad luck. Ethnicity and gender are only loosely correlated with bad luck but there is no causal relationship between them (not so much anymore at least).

This is wildly ignorant and ahistorical. There are literally thousands of books, articles, studies, movies, etc. disproving this. Literally just this week a study was released showing that predominantly white school districts collectively receive $23 billion more in funding than predominantly black districts, and that: "For every student enrolled, the average nonwhite school district receives $2,226 less than a white school district,".[1] That isn't bad luck; that is a system designed to reinforce a system of racial segregation, and it's just one example of thousands, all of which are a moment of research away if you actually cared about this.

[1]: https://www.npr.org/2019/02/26/696794821/why-white-school-di...
For an open source project, I'd recommend using an autoformatter, documenting it in the contributing guide, and enforcing it in CI so that anyone submitting a PR can clearly see if they submit something that breaks the formatting rules. I am much happier contributing to projects like these rather than trying to figure out all of the nuances of the author's preferred formatting style. Working with autoformatters for the last year or two has made me care much less about things like tabs vs spaces, I just care that the tooling is set up so that I don't need to think about it.

As a concrete example (for JS projects), you could configure Prettier to use tabs for indentation:

https://prettier.io/docs/en/options.html#tabs

Then you could use eslint-plugin-prettier, which fails lint if the code isn't Prettier-formatted and makes ESLint autofix also run Prettier:

https://github.com/prettier/eslint-plugin-prettier

Then set up lint to run in CI alongside tests.
But no one is going to pay $330k to a 17 year old with no experience
> No one has faith in the government.

Judging by how emotional many people get about elections, that doesn't seem true.
I've never had this happen but what I've had in the past is people saying "This isn't a vulnerability", then I told them I would go public with it with an Easy POC that anyone could do.

Example: http://writecodeeveryday.github.io/projects/badqr/

I literally had to twist their arm to get it patched... since was a something to 'reduce friction' which allowed you to steal someone's Bitcoins.

At the time, the POC would have netted me $40 for every person I scammed, today, it's a $400 profit and that tool would generate a QR telling people there's free bitcoin at Coinbase so I bet you someone would have used it.

Edit: I told my boss if they didn't do shit about it, I would put that QR code with 'Social Engineering' into Facebook ads since it had just started and see how much money I made out of it.
This is so fun, wasted probably 30 min building mazes.
Even if that's true, it doesn't matter. Consumers are using Google, so there is not really a free market for search ads from thee marketers' perspective.
Why plate-less?
It's more likely that low hanging fruit bugs have either been found before or internally by the company, just not yet fixed. Anything that tools like Burp identify is of risk of having been found already by someone else. It's a tough competition where in the grand scheme of things the winner is the company.
> It's not something to be emulated.

Which part? Driving a Mercedes (probably $50-100k) seems much better than driving some exotic million dollar car.
I have a lot more faith in government—which has proven to be democratic, on occasion—than corporations which offer no levers of consumer control, and lie constantly.
> I understand there is empirical data showing how race is correlated with zip code, but you still choose your zipcode at the end of the day.

Unless you live in a city that was redlined[1], which is to say, unless you live in virtually any city. In which case, you really did not and in many cases still do not actually have much of a choice where you live. And that's without even looking at the fact that the racial wealth gap means that even if there weren't still strong barriers to integrated neighborhoods, lots of members of groups that were and are discriminated against would be unable to move into the neighborhoods that would theoretically let them escape that zip code bias.

[1]: https://www.chicagomag.com/city-life/August-2017/How-Redlini...
The problem is, e.g. banks will want to use all the data they can to make a decision on what sort of loan to offer you. Employment history, travel history, family medical history, as much data on your spending habits as they can get, how much money your relatives have, which properties you own and are they likely to rise or drop in value, where, when, and how you drive (which affects likelihood of having a car accident -> unexpected expenses or death -> affects loan repayment), which websites you visit, how much time you spend on your phone, in bars, etc. etc..

Each has a plausible justification for inclusion. But the more data points you have, the better you're able to predict race from them (or anything else you're not supposed to).

So how do you decide if an algorithm is discriminatory? Maybe a whitelist or blacklist of what data it can use?
Nope. You are exactly correct. The way to approach removing bias in all personal financial decision making, algorithmic or otherwise, is to only allow it to be based on previous individual financial behavior.

The solution is pretty much that simple. I would argue that all correlative models dealing with human beings will always be discriminatory.

Will loans become more expensive for many people? Sure. But that is the true solution. Sometimes the right decision is simple but unconfortable. In my opinion, this is one of those times.
Openstack got good enough for people who wanted to run their own EC2 like internal cloud, right about the time that people stopped wanting to run VMs.