skysight-inc/HackerNews huggingface dataset:
> The average age of the infected is lowering, and they tend to survive.

An illness that lasts two weeks and then goes away is a shitty two weeks.

We're sitting at what, a shitty five months now?

I guarantee there are a lot of people out there who would take a rough couple of weeks over what we've done to their livelihoods this year.
He was 80 when he died and not all that young when he took a stand.

We are closer to barbarity in time and in fact than we are comfortable acknowledging. Vale.
I kind of like the messaging around this, but I don’t have the feeling we know an awful lot more than we did before.

I’m glad they at least seem to realize all trust is gone.
To fit in the suitcase and scatter the parts upon disposal. Much easier than lugging around a whole body and digging a human sized hole.
> We saw traffic drop by about 50% across our network. Because of the architecture of our backbone this outage didn’t affect the entire Cloudflare network and was localized to certain geographies.

I'm not even sure.. Is that second sentence supposed to signal some sort of success? Dropping 50% of your traffic isn't isolated. If your gonna try to spin it, at least bury the damn lede. Further:

> The affected locations were San Jose, Dallas, Seattle, Los Angeles, Chicago, Washington, DC, Richmond, Newark, Atlanta, London, Amsterdam, Frankfurt, Paris, Stockholm, Moscow, St. Petersburg, São Paulo, Curitiba, and Porto Alegre. Other locations continued to operate normally.

Locations with THEIR equipment, but certainly not all "affected" locations. I live 4 hours from Dallas and can assure you that I was impacted. That coverage is like.. Most of the United States, Europe, Brazil and who knows how much of South America? Oh right, 50% of their traffic!
Police Use Drones to Check for Nudity on Twin Cities Beach
How did they manipulate their employees? that's the most important part don't you think?
US Customs Plans to Tap into Nationwide License Plate Reading Network [pdf]
> For 45 of those accounts, the attackers were able to initiate a password reset, login to the account, and send Tweets

How did they initiate a password reset and successfully reset the password to login to the account? They must've had the owners' email passwords too?
EDIT: So they changed the mail associated to the accounts to their own... but the system didnt email out to "old" email to notify them of the action being taken like most companies do?
I don't know where you're getting your information, but the frequency of media coverage of a drug is not indicative of the market size. See e.g.:

https://fas.org/sgp/crs/row/R41576.pdf (page 16-)

>Cocaine of Colombian origin supplies most of the U.S. market, and most of that supply is trafficked through Mexico,

>In 2017, Mexico seized 421 metric tons of marijuana and eradicated more than 4,230 hectares of marijuana, according to the State Department’s 2019 INCSR. However, some analysts foresee a decline in U.S. demand for Mexican marijuana because drugs “other than marijuana” will likely become dominant in the future. This projection relates to more marijuana being grown legally in several states in the United States and Canada, which have either legalized cannabis or made it legal for medical purposes, thus decreasing its value as part of Mexican trafficking organizations’ profit portfolio.

However, the same report indicates I underestimated the relevance of heroin coming via Mexico. In this case, poppy production in Mexico has increased in recent years, so apparently "actual agriculture" is still not too much work for the cartels.

Unfortunately, opioid use is a much more difficult question, due to the "laser-like" effect of opioids: the capacity for non-drug pleasure is slowly degraded[1] and users may not notice until it's too late, similar to the way that the visual cortex will try to correct for laser damage until the retina is irredeemable. Decriminalizing any opioids comes with significant risk, since they are easily the deadliest sort of drugs.

Instead, approaches similar to that currently applied in the Netherlands may be more fruitful. A bright spot is that medical cannabis seems to decrease the likelihood of opioid prescriptions, which narrows the medicine-to-streets pipeline.

1: https://www.nature.com/articles/npp201317
My first step in filtering crank papers is to ask is this written with Microsoft Word.
Wording is suspicious, you would assume they mean "they had no db access so they didn't see the hashed passwords". Hopefully it just wasn't completely thought out.

The only other reference to password storage efforts:
https://blog.twitter.com/en_us/a/2013/keeping-our-users-secu...

> attackers may have had access to limited user information – usernames, email addresses, session tokens and encrypted/salted versions of passwords – for approximately 250,000 users.
How many people have you met that were homeschooled but you just didn't know it? Hard to really quantify something unless you ask the question of every person you've met.
I'd love to get my hands on an electron microscope. I recently purchased a good microscope, and for the first time in my life I was able to see things like blood cells, and microorganisms. It's amazing... life changing even. I had used cheap microscopes before, but the difference is truly amazing. I can't believe I went this long without access to a good one.
This was an iBGP issue, not eBGP.

It is entirely possible to cause a similar problem with OSPF or (lol) IS-IS, with the “right” misconfiguration and route metrics.
I've been considering getting this. How's the Linux experience?
That’s a different scam that has been going on for years. They phish/crack random, usually inactive, verified accounts. And then they chance the display name / profile picture to Elon’s. Then they reply to his tweets with this message
With WireGuard, it is easy these days to setup a VPN on our own server(https://www.freecodecamp.org/news/how-to-set-up-a-vpn-server...). Obviously it won't give us anonymity, but it is a good choice for security when browsing from public wifi.
It's amazing to me that in this situation, humans still had to intervene and update a configuration file.

I'm surprised stuff like this wouldn't happen more often and there would at least be a well tested, automated remediation step in place which also validates the change prior to going live.

I get they may be busy solving other issues, but it's interesting this isn't a more fool proof procedure given the huge impact a mistake can have.
Those have been happening for a long time before this, and consist of taking over some some little-known verified account (presumably through phishing, password reuse, and other such conventional means), changeing the (non-unique) display name and profile picture to Elon Musk and doing some bitcoin scammery. The actual well-known accounts are unaffected.
You can use @import to include shared CSS files. HTML import is still pending in the standard committee; should come soon. For now HTML template needs to go with the Javascript.

I usually structure a component like the following. The nice thing about WebComponent is everything is scoped to the component and you can have pretty generic names for things except the defined component name ("component1" in this case).

/components/component1.js

import cu from "/util/comp-util.js";
import comp2 from "/components/component2.js";
import comp3 from "/components/component3.js";

(function() {
let template = `
<template>
<style>
@import "/styles/shared.css";
@import "/components/component1.css";
</style>
<div id="the_component" class="component1">
<button />
<component2 attr1="green" attr2="10" ... />
<component3 ... />
...
</div>
</template>`;

class ComponentElement extends HTMLElement {
constructor() {
super();
cu.attachTemplate(this, templete); // the attachment boiler-plate code in util.
}

...
}

window.customElements.define("component1", ComponentElement);
}());
No, she wasn’t. She was a fraud from top to bottom — but she still convinced investors, powerful people, and talented engineers to invest in her, defend her, and join her company. She’s morally bankrupt but her lack of engineering acumen isn’t related to that.

Levandowski is morally bankrupt too — and sloppy when it came to covering his tracks — the fact that he’s a brilliant engineer doesn’t make his actions more palpable.

Both are bad people and I’m not comfortable giving a guy a pass just because he was smart. Ultimately, he was just as greedy as Holmes. He wasn’t satisfied with the nine figure payouts both from Google and Uber (and his Uber money could have exceeded ten figures depending on stock options) and had to go for even more.

Fuck that guy. Fuck Elizabeth Holmes too, but Fuck Levandowski.
I wonder if ZeroHedge prediction might end being accurate:

That attackers probably would get most of their profits from blackmailing people because of their DMs.

I had hoped the hack was just API abuse to tweet in someone's name, not an actual account takeover, this introduce a whole lot of issues (including the fact some world powers use twitter... ever thought what would have happened if they had hijacked Trump's and Khamenei's accounts and started to give plausible threats to each other?)
I became fascinated with spintronics for about a year. Somewhat unrelated, but perhaps interesting to some readers, is that you can create spin-LEDs. If you use a material to permit only electrons of a certain spin (spin-up or spin-down) to transport to the excitation layer of the LED, the resultant emitted photons will be helically polarized. Fascinating stuff.
Thank you for the response and information. Unhappy coincidence.
In some old articles it was mentioned they used Bcrypt.
Not sure if that has changed. Not so many new algos are proven to be good.
> "passwords are hashed and salted"

Means something to you and me, but means nothing to the average Twitter user who is the audience for this blog post.
Customs and Border Protection Bought Access to Nationwide Car Tracking System
I believe that’s just a fake screenshot of an Elon Musk tweet.
They changed the email addresses first to an account they controlled.
I would have assumed CF had a simulation of their entire network(including their peers) where changes would be applied and vetted before rolling it out..
As I understand it, the internal tools allow for changing the email. Change email -> password reset.
> There is a lot speculation about the identity of these 8 accounts. We will only disclose this to the impacted accounts, however to address some of the speculation: none of the eight were Verified accounts.[0]

[0]: https://twitter.com/TwitterSupport/status/128433914877449830...
Who the fuck are you to decide what to build in Morocco, or not? When I look at [0] https://en.wikipedia.org/wiki/Morocco
it looks rather civilised now. And has for long times, until western colonialism meddled with it. Very rich history! They even have an expanding high speed rail service operating at 200mph. Beat that!

Also: Masters of Kif!
There has to be a trend manipulation option, otherwise the trending algorithm sooner or later will become a liability. What social media giants lack is transparency about when, why and how are trends manipulated. Transparency is also a liability for their business model.
I'd assume they had the ability to change the email on the account.
Absolutely! Insofar as a post mortem will help others avoid the same fate, understanding the specifics of the social engineering hack is by far the most useful information they could share about what happened. My guess is that they won't because either a) they are lying about this being the underlying cause, or b) it is itself too sensitive to reveal (either about the company or the targeted individuals).
Can't tell which part you mean by "this." The pictures, or the Jack testimony.

You have one of the best usernames ever btw.
What a lousy bribe! I’m sure some money changed hands as a signing bonus or something but if I’m running a scam I don’t want to have to pretend to be an executive afterwards!
You're still not making sense. Why would these firms want to retain executives who drove them into bankruptcy in the first place?
It's old-school plain-text email etiquette. The original Markdown even used a variant of that syntax for its links definition, known as "reference links". https://daringfireball.net/projects/markdown/syntax#link
I will use this as an ugly reminder that it's better to assume that any DMs could be public at any moment.

I don't subscribe to the "nothing to fear, if you have nothing to hide", I had conversations that are not illegal, lewd or even non-politically correct jokes, but would still hate to made public by a 3rd entity; from secrets that were shared by friends, to sensitive data like addresses, or information with clients with NDAs.
> We’re 50 different states with a federal government, which doesn’t have public health as one of its assigned roles.

COVID is clearly a national security issue, which is squarely a matter for the federal government. The prior administration made pandemic response part of the national security apparatus (i.e. the NSC). According to public testimony, this continues in the current administration despite a reorganization.

You claim a bare recitation of fact, but in my view that is completely inaccurate. There is a fundamental misunderstanding here. One of the first iterations of our government under the Articles of Confederation didn't have a strong enough government to respond to national security threats and we could have lost the war for it. Having a strong federal government that can accomplish things the states cannot is literally the reason for our government as it exists today.

As I mentioned, by our own government's admission pandemic response is a national security issue. There are two additional reasons why this is clear. First, what if the pandemic was started by a biological weapon? Would we still leave it to the states then? Certainly not, yet it would be the same exact pandemic whether started by terrorists or by accident. Second, COVID is going to cost hundreds of thousands of lives and billions of dollars. On and don't forget it literally took a nuclear powered aircraft carrier off the battlefield. It is then by definition a national security issue because of how weak it makes our country.

I generally enjoy your writing on these issues but I think you have the basic structure of our government completely reversed. We threw out the Articles of Confederation and created a stronger federal government because disjoint states did not have the ability to respond to massive threats at the scale of COVID.

One you throw out your designation of COVID as a public health matter and recognize it is an issue of national security (again by our government's own admission) I think a lot of your other arguments do not hold up. Some things that you mention as a matter of law are clearly correct with respect to masks. But the idea that "nobody thought pandemic response was mainly a federal responsibility" is completely false and counter to the ideals of our government after the Confederation Period.
I read that as "It does not affect Asia". Which, while it's totally a wee hour, match what my monitor is telling me.
I'll have to give this a try on my Raspberry Pi 4 4GB. I've setup Ubuntu, Arch, Kali, Raspbian, and Raspberry Pi OS on my Pis, but this'll certainly be the most exotic, given that it's not Linux. Do you know of any bare metal Forth- or Lisp-based systems for RPi?
Nothing about how they are fixing their internal processes that enabled individual employees to do password resets. Can anyone at twitter get control of any account? That seems problematic.
So you agree that they're breaking the law by impersonating police?
I remember that answer to "What keeps you up at night?" of a major security advisor to be "Our employees! They click everything!".

Fitting video: https://www.youtube.com/watch?v=bLXW2JQ0TZk

Training to prevent these social engineering leaks is definitely critical.
I mean yeah but at this point you are basically admitting that keeping the company alive is more important to you than treating your employees equitably. Entirely possible for others to disagree with that stance, though your position does make sense if you take it.
> His battalion had 250% turnover during the war,

Ye gods. That reminds of Felix, a character from the book Armor, by John Steakley.

> It turned out the Japanese had stuffed the hill with explosives

Well, there you go. Nothing is new under the sun. Beneath Hill 60 [0] is a movie about the Allies doing the same thing to the Germans in WWI. The explosion was heard in London, about 250km away. It killed around 10,000 Germans [1], but according to the movie had very little effect on the eventual outcome.

I thought it must have been pretty unique event. Apparently not.

[0] https://en.wikipedia.org/wiki/Beneath_Hill_60
[1] https://www.military-history.org/articles/world-war-i-hill-6...
Oh no, not the dark mode! The sacrifices we have to make for performance I guess...
Every single pandemic in history was naturally occurring, so I think it makes sense for our priors to be weighted towards COVID-19 being a natural occurrence like all others.

Substantial evidence and compelling arguments can overcome these priors. But it’s a big claim with huge implications so I think caution is warranted.
Another reminder of the importance of taking the periodic, thoughtful moment to document the type of imprint each of us would like to have left on this world once we're gone.
>none of the eight were Verified accounts.

That just raises more questions for me! It would make sense if an attacker was trying to pull the data of some celebs/VIPs as an attempt to hopefully strike gold. But for them to do it on some non-verified account? That makes it seem like these specific individuals may have been targeted. If the attackers were just randomly picking accounts to download, I can't imagine them picking solely non-verifieds.
Exactly, that is what I was hoping to find in this article. But if they disclose it might open up new opportunities and so quite possible we would never know.
It's possible to have an immoral result without any individual doing an egregiously immoral thing. In fact it seems like a lot of law and corporate structure encourages these situations. Some examples that come to mind are paying low level employees such that they need government assistance, or situations where a corporation can break a law and profit more than whatever fine they might receive.

Corporations are legal and social entities. It's reasonable to consider what our laws and customs allow or encourage in an effort to nudge society towards a more just future.
Fritz Haber wasn't exactly super popular well... anywhere for contributions to WWI or WWII.
Doesn't mean he was any less credible as chemist.
FYI, your commits are signed with "Your Name <you@example.com>". You'll want to fix your git config. For these existing commits, you can use git-filter-repo [0] to rewrite the author name and email.

git filter-repo --force --name-callback 'return b"Name to use"' --email-callback 'return b"emailtouse@example.com"'

[0]: https://github.com/newren/git-filter-repo
His account might hold the secret to the Twitter hack. He died 2 years ago
He was my representative before redistricting.

If you don't know his story, it's worth taking the time. He got himself beat up to unconsciousness so that the rest of the United States would not be able to ignore the brutality of its racist South.
The explosion of new coronavirus tests that could help to end the pandemic
> on Wednesday, July 15, 2020, we detected a security incident at Twitter and took immediate action.

> We became aware of the attackers’ action on Wednesday

No mention of how they detected the incident or what alerted them to the attackers' action?
Corrected link to the app store: https://play.google.com/store/apps/details?id=com.noodlesoup...

Sorry for that mistake...
Most crypto places force you to provide ID now and governments force you to declare how much you have. Both for tax reasons.
Ah yes the sweat stains shirts.
Didn't realize Qt updates were such a disaster...

Interesting to me that they went for "Rendering Hardware Interface" with their own "cross-compile shaders both at compile and at runtime". I wonder about the exact scope of this work, and if they considered Vulkan Portability instead.
Someone pointed out that it could be targeted at activists...
It's seems these major infrastructure outages always are from a configuration change. I remember Google had a catastrophic outage a few years ago, and the postmortem said it all began as a benign configuration update that snowballed worldwide. In fact I tried googling for it and found the postmortem of a more recent outage, also from a configuration change.

Some seasoned sysadmin will say to me, "Of course it's always from a configuration change. What else could it be?" I don't know, it seems like there are other possible causes. But in today's superautomated infrastructures, maybe config files are the last soft spot.
Compliance can make you do something that looks like code review, something that looks like testing, something that looks like runbooks, etc.

That can't will into existence engineers who are actually thoughtful, creative, and skilled at those things. They can't make the test suite actually anticipate the bugs that will be written. They can't make the runbook have correct steps with no unwanted side effects for every failure mode. They can't make the reviewer see what the author doesn't.

Two, maybe three people in my 100-person org are legitimately good at this stuff. No amount of grandstanding about what a serious business we are changes that. In fact the people most enthusiastic about compliance and process usually end up undermining the real, substantive technical quality that the compliance process was aiming at.
Spain and UK all had a fair amount of drama and government incompetence, still have worse death/1M stats than the USA by a fair margin, and are forecasted to be hit harder economically (-11% vs -7% USA in 2020 GDP). It's still way too early to tell if they are actually going to end up worse, since this is still going at full swing in the USA, and there are a lot of uncertain factors, but I think there's a fair chance they end up being as bad or worse than USA.
These blacklist tags are "not new"* and are, for the most part, a necessary moderation tool to keep explicit and/or harmful content from trending.

Now, is this potentially something that could be abused to truly curate away ("censor") content from individuals, particularly conservatives, posting in good faith? Sure. It could.

But let's think about this -- if Twitter didn't have these tools in place, there are plenty of bad-faith actors who would constantly push profane and/or derogatory memes up into the realm of trending content. To me, preventing such content from trending is a necessary part of the service Twitter operates.

The unfortunate fact of the "profane" that there is no broad consensus around what is and isn't offensive. This means that Twitter will naturally step on toes in the process of keeping their platform friendly to the masses. I honestly don't see a way around it, and I far prefer a world where more people feel comfortable than the kinds of content I see on, cough, alternative "free speech" forums. But maybe that's just me.

* source: https://www.vice.com/en_us/article/n7wdxd/twitter-blacklists...
I love Krita. This (the qt breaking things piece) is obnoxious.
If this is true then it completely defeats the purpose of a two-factor authentication
That's kind of a cynical take. I parsed that statement as saying:

> did the attackers see any of my private information? For the vast majority of people [who we previously mentioned were affected by this hack], we believe the answer is, no.