skysight-inc/HackerNews huggingface dataset:
We were on the gold standard in the late 19th century and the economy grew very fast. A fixed money supply puts more economic power in the hands of the industrialists and their retained earnings instead of the banks.
Startups introduce new liquid cooling designs
I don't really see a reason they needed to be super transparent about that fact. It doesn't really have a significant security impact. It's just a small QOL improvement they implemented.
I can't see Nominet letting it happen.
I disagree that it's technically trivial for the audience this article is written for. The suggestions on the page are all as simple as using a particular browser, search engine, or browser plugin.
So, how feasible is this as a remote worker?

What I am really asking is, how reliable is wifi/internet and is it available through the entire journey?

I would not mind a workcation this way, but probably could not afford a satphone’s data plan.
> and the other is a very easy mistake to make which can go unnoticed for a long time (because you can be attempting to log things completely unrelated to logins).

This is not an excuse. If you're logging all request data, you need to strip or encrypt sensitive information in that request data. Handling Persistence of sensitive data is web development 101. Just because it's not in a database doesn't give you a pass to leave it unprotected.

This level of incompetency is unacceptable.
Swift UTF-8 String
Why Free Chatbot Builders Are Useless?
This isn't a case of a company intentionally storing passwords in plaintext in their database. That's a big security no-no, because password hashing is such a basic and fundamental part password-based authentication that it's nearly impossible to miss if anyone involved in maintaining that system is remotely security-conscious.

This situation, on the other hand, seems to be more of an unintentional capture of passwords by their logging system. That's much harder to notice and more akin to a bug or security vulnerability, which is something pretty much every system suffers from sooner or later.

In such cases I'm more concerned with the company's response to the vulnerability than the fact that it exists at all. Here it seems like Facebook noticed the problem and proactively fixed it before it was exploited, which to me is a good sign.
LOL. loved your comment! You hit the spot with your assessments and thanks for doing the research behind it. I think I should probably run best and worst case scenarios with the cap table alongside me. I agree that from the looks of it, it's pretty risky.
I'm not a particle physicist, I just copy and paste paragraphs.
I think this is just an extreme boomtime mentality. Investors are cashed up, and so are the large tech companies buying these startups. Valuations are so high that building companies to flip is just too damned lucrative to do much else.

I think part of the difference between the late 90s and now (besides scale) is that small IPOs don't exist anymore. VCs need exits and once founders own n% of a $100m company, they need a way to realize those, unless they're willing to totally ignore their own financial interests.

The 1990s IPOs didn't work out well though. These companies were still longshots, and public markets lend better to lower risk-reward companies.

The second part of the problem is tech "monopolies," in the thiel sense. Google and FB's business models, for example, needs massive scale. A social network or search engine with 10% of the user's is not worth anywhere near 10% of what FB or google are worth.

So... the "highest value use" of a smaller startup is to help maintain a larger company's monopoly.

Finally, the tech space (especially consumer web stuff) just changes too fast to "build something lasting."

.. I'm not sure everything needs to be lasting. Do we even want dating apps or online loyalty programs that last a century? Maybe we just need classier ways of doing shorter horizon stuff.
>They will result in an endless litany of broken banking websites, annoying support calls, memory issues, and in general a terrible user experience for others.

This is some FUD you got going on here. Changing DNS will break notjing. Neither will blocking referrals, blocking trackers, blocking ads. In the rare case it does, you're one click away to disable everything! Neither will your system get slower, much to the contrary you will save memory, network data, and battery.
This is exactly my experience as well. It hasn't been such a problem because I use CloudFlare as my DNS provider, but not having the option is problematic. It's less "CloudFlare Registrar" and more "CloudFlare lock-in service".
I have to follow up on this though -- Did the person in question just not have your phone number or email?

Disabling uBlock Origin is literally two clicks. I understand someone not knowing how to do that -- I don't understand not being able to explain how to do it.

And even in the crazy case where someone drops a course, that's still a preferable scenario to me over helping an Uncle remove a keylogger because a big scary box told him to click it on it.

When I set up a computer for someone I either need to teach them how to whitelist a site, or I need to teach them Internet security, which is not always possible to do. I think it's irresponsible to put someone online who's not an expert without at least some protection to keep them safe.
how much daily traffic does running your own DNS server generate? (to keep up to date with the domain-IP binding?)

I am really interested in trying this...
GitHub Action CLI-tool to script updates of them on many repositories
All the more reason to make the client side send HMAC(HMAC(username + password) + Unix Epoch rounded to last 5 min block)) over the wire in its POST to the auth endpoint.

All the transport encryption and DB encryption/hashing/salting won't protect you from this kind of logging mistake, but the above would.

P.S. There are ways to make the above even better by adding a nonce that has to be requested from the server before POST etc.
I used to have a Macbook 2017 and XCode development was kind of slow when you run the simulator, but then again, it is completely usable, and the Retina display is so worth (this was before the new Macbook Air).
Can happen for sure.
Have seen it happen in other places too.

But this going on for up to 7 years?
Yeah, I'm less than impressed by FB.

Had a less than stellar opinion of them before, they are definitely hitting the Mariana trench now.
I disagree that they are both terrible security designs. We expect every company to not use plaintext for auth. We do not expect every company to have infra/ops setup to prevent logging on login requests.
The folks that live down the block from me are people. A multinational investment firm is not people.
> Quite frankly, I was a bit surprised so much of the discussion has been about LISP features that are neither in dispute nor subject of the article.

It's because Lisp macros and their motivations were described inaccurately, and some people want to make sure that these inaccuracies are not perpetuated.
From the paper:

> It appears that more beautiful workers earn more, not because they are beautiful, but because they are healthier, more intelligent, and have better (more Conscientious and Extraverted, and less Neurotic) personality.

But that makes me wonder, isn't health, intelligence, or personality usually how we qualify "beauty" anyway? The paper is pay-walled so I didn't get a chance to see how they quantified "beauty" in this study.
Coincidentally, I was watching Brave Dave doing freight hopping all over North America. For the brave at heart and with tons of energy, this looks a bit more exciting, and much cheaper.

https://www.freighthopping.com/
"Continuing the thought experiment, consider what goods and services people would continue to spend money on, in spite of the expected increase in the value of money."

I love this comment. Everyone just blindly says "People will put money in their mattress. Economy will go down" and then it's case closed.. but then what happens next? They just won't buy food? water? won't go to the mall? They just stay at home and hunker down? They won't even be watching entertainment since they won't be paying for a Netflix subscription too, apparently.
That's true, but it's practically impossible to bootstrap a "bullshit" company and have it succeed.

If you get into YC you're guaranteed intros to anyone in their portfolio, press coverage from valley PR machines like techcrunch and will have a much easier time cold calling if you need to because you have the YC stamp of approval. You'll also have a much easier time raising on good terms because no VC is going to pass up a meeting with you.
No we don't, law updates, regulation updates, and case law has made it clear that the principles of the ADA apply to websites as "places of public accommodation."
That's not fractional reserve, that's just fraud.

Exchanges are not banks.
> On Wednesday, I created a fresh Instagram account, and followed ‘Beware the Needle’, a user with 34,000 followers which posts a steady stream of anti-vaccination content.

Whilst I don't doubt that it's possible that Instagram's recommendation system will do this, you can't really complain or say it's the norm if the first account you follow is an prolific anti-vaxxer.
>The green movement does not have that kind of political power,

Disagree. Ignorance has immense political power.
You are right, it is not entirely free. I do see a baseline accessibility as necessary to call yourself a competent developer though. And you are right, a competent developer costs more than a bad one. But we are a community of developers here who, i would assume, think of themselves as competent. Should we not strife for a certain baseline standard instead of partaking in a race to the bottom? In the end, there is always someone that does a bad job cheaper than we can. I know there are often economical circumstances and we all cut corners one time or another, but we as the knowledgeable developers must be the one to educate the clients and put in the work, because no one else will.
>An ad-blocker like uOrigin can break online courseware and banking sites. If you install it on a student’s machine, and the ad block you consider ‘mandatory’ damages their experience, they might decide to drop (or fail) their course if they can’t figure out how to undo the damage you’ve done to their browser.

Click ublock logo > click big obvious shutdown symbol. That's it.
I think the amount of VC bashing in the post is unwarranted. It makes it sound like VCs make fat salaries on the backs of other people - either in form of investment or startup founder's hard work.

The fact is that some founders, including the author, feel that VC confirmation is a validation of their idea/business. So, while founders shouldn't raise huge amount of money for niche projects they do it anyways because that's how they see validation of their idea.
That "independence" is a fast-dissolving illusion.
When I say 4chan, I mean /b/, which I think is pretty typical.
Yeps. And at Facebook-scale, when you realize the issue after it has went live you have already "stored hundreds of millions of user passwords"
Uprising app monetization models with public data collection
I did the Shanghai/Beijing bullet with some friends who had never been to China, it was great perspective for them and me to see all the massive cities in between that are not known outside of China but the size of New York City
Every time I've thought about moving away from Namecheap to something else I've remembered those once in a blue moon times I've actually needed to reach out to support for mission critical type of events. The support I've received has been absolutely stellar. Above and beyond what I would have expected to be their scope of service. I don't know any other providers I hold as highly in support, especially anything coming from a tech company.

My main gripe is that I wish they would include free SSL and they give their UI some love but that's minor as I only access it on certain occasions.
I don't think it's correct to refer to a job ad as "marketing copy". A job ad should be clear, especially with regard to potentially discriminatory requirements.
Why does traffic going through the subsystem contain plaintext passwords?

It was my understanding yhat my password, on a properly configured login page, never left my browser, much less crossed multiple machines that had the ability to read it.
> Duke’s true “innovation” came not in the 1880s, when the cigarette machine transformed the production process, but in the 1890s, when business corporations shed the fetters of state regulation and radically redefined themselves.

This article runs off of this huge premise that there was no actual innovation, just clever and malicious rent-seeking. But do we really buy that inventing a cigarette rolling machine didn't actually radically reduce the cost of cigarettes?

Let's not throw the baby out with the bathwater - innovation is obviously an important part of the economy. We should not confuse it with rent-seeking behavior. Even in this case, it was a simple Patent that allowed Duke to establish his corporate dominance.
Bloodhound's 1,000mph car project given financial boost
My experience is that there was a fairly brief window in which founders believed an IPO was a plausible way to flip a company, and that before, during, and after that, the more common objective was to build a company to flip to some other firm that already had done an IPO. When we started our multicast company in early 1999, none of us believed for a second that an IPO was in our future, and our VC pitches (mostly guided by the VCs, some of whom ended up funding us) were almost entirely about who might end up buying us.
Because we all know we are one bad morning away from doing it ourselves. People are distinguishing between extreme incompetence (storing plaintext passwords in databases) vs people trying to do their jobs.

It's the same reason when there are large outages, where the comments are split between the enraged customers, and then the ones that are "Man, sucks to be them" as know they could easily have been the one that got the config push wrong.
There are many ways to bootstrap consumer facing websites and other businesses that require a lot of early capital, you just have to be creative. I'm just trying to get people to think outside the "VC is the way" mindset because it burned me and because the experience wasn't what was promised.
That’s certifiably depressing.
Another potential option, is Lightbend Config

https://github.com/lightbend/config

It adds includes/inheritance, substitutions, unit of measure parity , comments , and few other things -- on top of JSON.

does not have if-logic, loops, or arbitrary functions, however.

On plus side, the library is available in a number of languages, easily embeddable. And there is an IntelliJ plugin for it, to color the syntax of the config files.
Perhaps not in more mature organizations, but it's standard practice at every startup I've ever worked for. One place had the dev office VPN'd into production at all times.
> I find winter wasabi to be much sweeter than summer wasabi

This is a normal response in many plants. They accumulate sugars in cells in cold months. Sugar acts then as antifreeze protecting the cell's integrity.
An easy mistake with serious potential consequences. I'd be interested in hearing how Facebook will prevent this from happening again in the future
As a macOS/Safari user I find this terrifying, but as a computer security aficionado (and onetime pen-tester) I also find this to be a sublime work of art.
You're right, the impact is just as bad. I think people in this thread (including myself) are downplaying it because it's a very easy mistake to make, rather than a terrible design decision.
>sometimes paths would be appended to the URL instead of replacing it, making it grow indefinitely

Do you have a publicPath in your webpack.conf?

`publicPath: "/"`

Also make sure you a linking to="/path", not to="path"
I don't think that's true. Have you seen how they move cattle in trucks? Maybe more space than a human because they take up more space, but they stacked right next to each other.
Yes

https://www.sciencedaily.com/releases/2014/03/140318140757.h...
Honestly, I'm surprised a false advertising case hasn't been pursued if this is the case. Marketing practices this inaccurate are well outside the puffery defense.
It's not like it never happened before. Just read up on the great depression and you'll get an idea.
This happened to Apple on the desktop, CVE-2014-1317 - In that case, they were logging the body of failed API requests (hex encoded) to a file in /var/log. It turned out that the login request occasionally hit an error, logging your AppleID password.

It was easy to overlook, since as you said, it was intended to log something else (failed API requests), it only happened in the case of an error, and it was hex encoded. I only happened to stumble across it out of curiosity.
They have WiFi on some trains, and that's exactly what it is.
This should be the main takeaway. If true, then 2000 people decided not to raise the alarm. And 9,000,000 queries with results that had passwords. This completely invalidates the other thread of people discussing giving facebook a pass because accidental logging could happen to any company.
That's an interesting challenge that could be used test "AI"
Demolition Man called it "Taco bell was the only restaurant to survive the Franchise Wars ... So now all restaurants are Taco Bell."
Isn't this how most of democratic elections work with many different faces of leader and their different set of plans targeted to different groups of people.
Does the burden to separate lie and misinformation from truth along with the responsibility to choose the best not lie with electorate?
So? You still learned it. You can't learn to see if you're blind.
IME, the train is like an abbreviated version of a car trip. It's great for when you don't have the weeks to spare doing a driving trip right, but still want some sightseeing and the feeling of traveling.

I've done short-on-time utilitarian driving trips too (all interstates, etc), and I'd definitely choose the train over that.

It also doesn't constrain your other leg, which can be flown if it fits your needs better. If you're only going one way, I'd recommend going east to west on the train. The train novelty will get you out of the dense Northeast, and then you can settle in after Chicago.
According to Dominic Gates, with MCAS classified by Boeing as having a 'hazardous' risk level, it should not have been dependent on a single sensor.

https://www.seattletimes.com/business/boeing-aerospace/faile...
With 20,000 employees who potentially had access, there's no way of knowing if any password was abused. They should message their users to change their password, especially if they use it on other sites, just to be sure. And because many sites use Facebook OAuth, there's a lot of room for abuse.
While we've taken pains to isolate workloads from one another on EC2 and can show there's no known vulnerabilities that would allow information leakage between instances, we have customers who want that extra level of assurance that their EC2 instance is not sharing hardware with another customer. Dedicated instances fulfil this role.
https://aws.amazon.com/ec2/purchasing-options/dedicated-inst...

As for IAM profiles, security groups, and the other, they're all security tools that can be used, but they're only as good as the admin who wields them. But the same can be said for on-premise (non-cloud) workloads that are internet facing. The times I'd found SSH (or egads, telnet!) ports exposed to the internet on a boundary router were too many to mention. It's not a cloud-specific problem, but a IT training problem.

The good thing about cloud in this aspect is that when a customer is all in on say, AWS, you can enforce a high level of consistency in what those security controls should look like, which makes it easier to identify deviations. You can then pair that with features like AWS Config to automatically detect when you say, have an IAM profile that's been changed from the secure baseline.

So cloud can actually make your environment more secure, because you have security tools built into all of your services, they're consistent, and you benefit from all of the engineering and research that AWS puts into them, instead of having to design solutions for everything yourself or manage lots of differing products that all require their own training, runbooks, configuration, etc.

But regardless of the solution you choose, it will always come down to training your personnel to use those tools properly, because bad configurations can occur anywhere. Cloud can help minimize the occurrences of that, but only training will eliminate it.

Disclaimer: I'm a TAM with AWS.
> This is accentuated by the fact that bitcoin can't be used in fractional-reserve-banking.

I don't know what you mean to say here, but you can absolutely use bitcoin for fractional-reserve banking, just as gold was used through history. Pretty much since the dawn of banking, a bank collects reserves from its depositors, and then loans outs a designated fraction of those reserves. It's not like that process was somehow invented with the Federal Reserve.

What you cannot do is have a lender of last resort with the ability to print money out of thin air, who can then flood the economy with cheap money; But that has nothing to do with fractional-reserve banking.
Ask HN: Google is using our company's name, what can we do?
I run Stadia Maps (stadiamaps.com). Google just launched Google Stadia, their streaming service.

Obviously the products don't directly compete (video streaming vs online maps), but Google most certainly competes against us with Google Maps API. Additionally, this product launch will definitely affect things like SEO and name recognition.

Is there anything we can do?
Transaction costs are very significant. As soon as a wallet contains money it is save to consider it as real. Distributing your money to multiple wallets as a single owner is very costly and makes no sense.
Maybe many people were just using SELECT * FROM ... and got plain text passwords they weren't necessarily looking for.
Storing passwords in plain text is beyond a simple slap-on-the-wrist mistake, and it has real security implications.
The diffirence is intent and/or gross negligence. Storing passwords in plain text in a database requires a gross lack of security mentality in both design stages and implementation changes. It is also drilled into people's brains constantly about how bad of an idea it is. To put it simply, it cannot happen accidentally.

Logging like this can easily be attributed to an accident. The person who implemented this logging should get hit with some repercussions because he surely tested the logging and must have seen the passwords when glancing by eye. But other than that, this was clearly a minor oversight.
Sadly many companies did in their early days from that period (even when it was known to be bad). Blackberry had plaintext passwords stored in a postgres dB up until 2.0 of BES (circa 2007). More so as no constraints (yes many many people had a password of "pass","god" and the like).

So let us not forget legacy systems we have all encountered or read nostalgic stories about how old XYZ kit is still in use today.

Or to put it another way - the amount of work that went into Y2k, just to fix a date field, fixing a plaintext password is more work and we have had no password2k like event and any event is local with some company falling foul and by that - getting hacked and data shared publicly.

So even today, you can guarantee that their are still systems out there using plaintext password storage. Some will be legacy hangover reasons, but not all.

But it sure does make you think, how many legacy systems are still in use today and by legacy, they don't even have to be that old in some fields or work. Sure does make you wonder about satellite security given the age of some of those still operational and in orbit.