skysight-inc/HackerNews huggingface dataset:
Are very high profile accounts (like Trump) more secure than a usual password + 2FA, somehow ?

EDIT: Not that it would matter here. Just curious.
Cisco has set things up to protect against this by basically killing the secondhand martket.

I used to put up with Cisco's "you need to pay for ongoing support (SmartNet contracts) to get any updates/firmware - including for bug fixes and firmware upates for the modem etc." even for my home equipment when I had my CCNA and was still drinking the Kool-Aid trying to keep one foot in the Cisco ecosystem. And you couldn't buy used off eBay because they wouldn't sell you that SmartNet contract on it to get the updates/firmware.

I had a Cisco 877W modem/router/WiFi for ages back when I had DSL and, not only was it outrageously overpriced (I think I paid like $1000 for it), I also needed to buy SmartNet for it to get the firmware for the modem part of it to work properly with my ISP even new out of the box (Annex N support if I remember correctly).

TBH even if Ubiquiti's EdgeRouter stuff was the same price as Cisco I'd still buy it these days if it was my money instead because it is soo liberating to just be able to go to the website and download the firmware updates free forever. My EdgeRouter Lite was not only like 1/8th the cost of an equivilent Cisco but it is still getting free updates without even needing to register a login with them 5 years after I bought it and I haven't had a single problem with it in that time...
Hackers still posting using Elon's account: https://twitter.com/elonmusk/status/1283520825782566912
Elon Musk again - https://twitter.com/elonmusk/status/1283520825782566912
Seems more likely to me that it was a Twitter employee or someone with access to an employee's PC to reset passwords.
It's called "buying the dip" and it's not specific to hacks; it happens on all kinds of bad news.
Some states have GDPR-like laws that will absolutely allow you to request a copy of your assessment. That can be a good way to know exactly what went short (most companies don't expect this and will get VERY coy about what they wrote, but the law's the law~)

Either way, more interesting is your first line:

> Interviews are a joke and are as useless as randomly selecting people.

I don't have a source, but I read a study once that showed most engineering interview process is roughly as accurate in assessing success as flipping a coin. I didn't look into the methodology, but based on experience I'm willing to believe it.

Other fields don't have that issue because they don't use interviews as a proxy for performance. Either they use portfolios (eg: designers) where you can CLEARLY see the person's skills, either they use credentials (certifications, or just resume). The interview is just to assess those data points and to make sure expectations are clear.

In some fields (eg: trades like carpentry), people will look at the person's history and hire them. Then based on actual performance over the first few months, they may get let go or even demoted. Can you imagine a big tech company DEMOTING a software engineer? Blasphemy! But really, that's the only way to properly assess an employee.

Hire them based on their experience and claimed skills, have clear expectations, adjust after a few months. Then you can give a shot to the person with low experience who claims they "promise to work very very hard and learn quickly". You can have apprenticeships too! And we can save everyone the trouble of silly useless interviews.
Ask HN: If you were the Twitter hacker, what would you post and why?
Very nice, congrats to the Liz team :)

The new `const` and RAII/resource scope language features remind me of the golang discussion yesterday, someone linked Pike saying JS/TS, C++, Hack, etc keep borrowing features from each other. Of course we won’t fully converge on some perfect syntax any time soon, or ever, but we seem to be settling into a general consensus on syntax in general, and semantics of dynamic languages.
This is just circular reasoning. Countries with lower rates of cases/deaths "did well" and countries with higher rates "did poorly." The total heterogeneity across the types and timing of responses in countries across both groups doesn't ever seem to raise any questions.

In fact, that's exactly the implication of the Nature paper that's ostensibly the reason for this thread. The more we learn about pre-existing resistance to this coronavirus, the more we can figure out whether measures taken made a difference or were simply coincident with a less-vulnerable population.
I can't imagine the user's devices were targeted (e.g. Obama's cell phone), so this must be internal. Eff me.
Also, along with dropping the touchscreens, they've gone on a hard bent towards keeping the "driving only" information on physically separate displays from the "infotainment" part. Pure vehicle operation stuff is always straight ahead for the driver, while navigation and music is always on a separate screen a little to the right.
Which really puts into perspective the amount of power we have placed on social media. I wonder if this will spark a #deletetwitter movement?
In general, I agree. In this specific context, the suggestion feature appears to have been enabled as a result of the user uploading a photo. It's reasonable to assume if they uploaded one, they'll want to upload more in the future (and decrease the friction of doing that).
Sounds like they need to adapt to market conditions.
30 minutes later and it still happens, just after "Elon" posted a normal message. Hopefully most users have caught on to the scam by now.
Or it's been exploited for months/years to read people's DMs and private accounts and they decided to burn it now mostly for lolz?
Given the Twitter web interface is just an client of the Twitter semi-public API, I highly doubt this is it.
> Identity politics is liking a group because you feel a primordial tribal identification with the group

And again I tell you that this definition is fake. It's not the way these groups think about this at all. And more over it's fake in a deliberate way, designed to fool YOU, as a member of your particular libertarian subculture, into discounting the political desires of other demographics by leveraging YOUR trust in your own group due to "primordial tribal identification".

Seriously: I know you think that your desires are "real" and these other groups are just "identity politics". You're wrong. All desires are real.
The press release is better than the link:

https://www.genome.gov/news/news-release/NHGRI-researchers-g...
Twitter support tweeted: "We are aware of a security incident impacting accounts on Twitter. We are investigating and taking steps to fix it. We will update everyone shortly."
"I forced a bot to watch 1000 hours of [blank]" is just a meme.

https://twitter.com/search?q=I%20forced%20a%20bot%20to%20wat...
Then why not go big and hack @realDonaldTrump?
This in no way jibes with my experience as an employee. I know the value I provide, how long it would take to replace me and how much the company has invested in me and there is zero chance that I get fired tomorrow. Theoretically my boss could wake up and fire me, but practically there are many reasons whey they "can't". Similarly, it is very rare to see someone get fired in the first 3-6 months on the job unless they are ridiculously unprofessional or unqualified. There are high-profile companies where it could happen, but they are noteworthy because it is so out-of-the-ordinary.
> A premium car with premium luxuries like bluetooth, air conditioning, GPS, self-driving, power windows, heads-up display, that button that open doors on minivans, airbags

Of your list, the only thing I'd consider a premium luxury today is a heads-up display (and self-driving, though I'm heavily cynical on the _current state_ of self-driving).

Tesla isn't being compared against 1950s era trucks, it's being compared against 2020 models. Of your list, I'd not consider any of those other items gizmos. I mean, airbags? AC?
If they did, they would be running the self hosted option.
It’s unfathomable to me that they don’t have this button, but equally so that they haven’t pressed it.

Edit: There we go.
https://twitter.com/JacKnutson/status/1283527213606789121
Can Twitter put up a banner warning folks not to submit crypto???
Imagine what "could have been" done.

Simultaneous compromise leading to tens or hundreds of millions of people receiving the same / similar messages for over an hour from the people they trust the most.

Death and destruction waiting to happen.
The attack didn't start until after the markets closed.
That's not what I meant.
But technically yes, Apple doesn't pay VAT, the customer does.
It's a very interesting line of thinking when a government that allows a company to incorporate, protects the company's physical and intellectual property by force and with a large legal apparatus, enforces the company's contracts, trains the company's workers, is somehow considered a robber when they ask the company to pay taxes.
His eagerness and excitement at the time could have been more closely related to Nokia N900's novelty (2009), since the N9 was released two years later (2011), and the concept wouldn't be as surprising. That's why I went with the N900 with my guess. In any case, considering both phones flew under almost everyone's radar, you might be right: it could be either one.
OP probably ran into the HN character limit.

Edit: Upon testing, that appears to not be the case. Probably a typo.
Also protects the stupid. You can still send this address BTC. You just need to withdraw it to your own wallet first. Which buys the user time in which to discover it's a scam
There are roll on/roll off car carriers with solar panels on top so they can use less port power when docked. Can spot them in SF from time to time.
Conspiracy theories do have a pseudo-religious character, but I'm not sure there is anything specifically Christian about the phenomenon. Many Christians, even conservative Christians, disagree with them. Conversely, conspiracy theories (albeit mostly different ones) are popular in countries where Christians are a small minority, see for example https://thearabweekly.com/why-conspiracy-theories-thrive-mid...
All in all that looks like a poorly thought out attack. So much more could've been done than cryptoscam.

Considering execution, it may be that this is some API 0day which does not show (or make it hard to guess) which account messages are being posted from. How else would you explain neutral messages for all account when you could've personalised it per account to maximize efficiency.
Why anyone take such a big risk when they could play with stocks with one account.
I'm not saying pair programming, though that is an interesting addition. Just having them collaborate on the code, knowing where their roles lie. You see knowledge transfer happen, which will benefit both sides, because you also want to expose engineers to the theoretical. They'll come back with wild ideas that the domain people refine. It's really quiet beautiful to watch happen, they each make each other better together.
1.2a feels to me like GA. There's not much HW wise that I'd consider an issue anymore.

There are things that could be better, like having a different WiFi chip, that would have a better [actual mainline] driver support with working power management. Not sure how likely that is. Probably not much.
> small, neighboring state

That "small, neighboring state" is a №2 state in NATO
113k is a little reward?
...so what? People tweet garbage all the time. There are already millions of twitter spambots.

What's so horrible about a few more?
It has border disputes, but it hasn't been involved in any major military conflict since 1979.

Most (probably all) countries in South and East Asia have multiple border disputes. Japan has disputes with China, Russia and South Korea. India has disputes with Pakistan, China and Nepal, and used to have disputes with Bhutan, Sri Lanka and Bangladesh. See a trend? Every major country in the region has or has had disputes with every neighboring country.
I wonder if this is hack in the sense that the account passwords were compromised or that the system itself was compromised in a way that would allow the attacker to tweet from any account.
Apple didn't have any normal tweets before the incident as well. Apple only post sponsored tweets.
I don't think it's relevant. Her business is designed to get you to game and pass the interview regardless of whether or not the interview is effective.

Therefore her business interests are orthogonal to her opinions on "interviews." She may still be biased, but I don't think business interests color her bias.
Could have paid/convinced/threatened an intern/employee to scope it out and then deployed the hack externally to bypass safety measures. Complicated but doable.
>Workers are also a pretty big beneficiary

You mean all of the workers at foxconn benefiting from their innovative suicide nets?
Some people may not take your comment seriously, but I don't understand how a software update fixes this unless something like this is going on. When I put my earbuds in the charging case, they power off (which disconnects from bluetooth) which means they shouldn't be running software to the best of my knowledge. Do the Amazon ones not do this?

I would be interested to know. If you have these can you please let me know if the bluetooth disconnects from your phone when you put them in the charging case?

They could still be storing audio on the earbuds or charging station itself then transmitting when connected but that seems somewhat unlikely.
Not as extreme as demonstrating that they evidently lack the ability to stop it...
Still a classic but 20 years later the frontier is at more like ten million connections.
i saw another one 2 minuses ago. remarkable twitter has not fixed it yet.
It surely means it's highly premeditated, but doesn't necessarily mean it's a hitman. The Stephen McDaniel case is an example of a boring-seeming law student showing similar levels of planning when murdering and dismembering a woman he was stalking.

The fact that there were screams loud enough to concern neighbors could suggest it wasn't quite so professional. If it were a professional hitman, why not use something guaranteed to instantly and silently incapacitate him, first, then focus on cleaning up the evidence? Or did they try to, but it didn't go as planned?

One possible explanation would be that the goal was to send a message (to him before his death, and others after it), not to try to make him disappear without a trace. Though, either way, it doesn't necessarily mean it was a professional hitman.
Does this mean that Twitter is now not to be trusted?
Amazon consistently fails in the browser for me with 1Password + Android.
I will not argue that Tesla is doing things differently. I have one gripe with the absolute truth suggested by "good for the planet and its inhabitants" that so many EV manufacturers ride on. Are electric cars good for the planet? Nope. Are they less bad than gas cars? Maybe. It's like saying that Diet coke is good for you because it replaces normal coke that is bad for you. That's an erroneous and arguably dangerous dichotomy. Sorry if I'm being facetious but that kind of marketing bothers me and I believe is damaging (to the environment in this case) by making us more inclined to settle for non optimal solutions.
Via Tyler Cowen [0]:

> If you've ever watched Goldfinger, you have to wonder if the real ploy isn't somewhere else, such as auctioning off DMs, blackmail, etc., and the bitcoin thing just proof of concept.

0: https://twitter.com/tylercowen/status/1283518906041278468
This is absolutely not true.
They're wasting time and money on purpose too, the dead rapper XXXTentacion just tweeted: “Smoking a fat blunt on my private island giving out bitcoin to my supporters”, Elon tweeted "hi" etc.

They also can't be stupid enough to not understand that using a single address that is blocked in most web wallets now is completely dumb.
250+ craft breweries just in Ontario: https://www.ontariocraftbrewers.com/FactsAndFigures.html

Then there's Michigan, Wisconsin, Minnesota, Illinois, Indiana, Ohio, Pennsylvania and New York, and that's not including the St. Lawrence seaway that has Quebec, New Brunswick, Nova Scotia, PEI, then New Hampshire and Vermont. Intracoastal you can't really sail, as it's motor power, which would be off brand, but enough in the region to try it anyway.

20+ distileries: https://www.ontariotravel.net/en/social/blog/article/8903

By linking it to the low carbon footprint of sails and the geography of the waterways, the brands would be relatively resistant to pressure from globalization given it's a luxury environmental product. I know people in both sailing and heavy industry logistics who would think this was nuts, except.

Depending on trade treaties around these products, we could probably get exceptions to them on environmental grounds. Ideally there are some existing tariff protections or something that keeps these craft companies out of each others markets already that we could use the environmental path as an exception.
I totally share your fears. I am afraid we are already too late. Though, pleading for moral decisions seems to have worked in the past. Again, see civil rights movement, women's suffrage etc. Let's just hope it will work again, and that it won't be too late.
> What JD power does is make a massive number of categories to give awards in.

This is common joke between friends. "Best in class HD towing" is something you used to hear on Chevy Silverado commercials when they, in fact, had lower tow ratings than F150 or Ram at the time. "HD towing" seemed to be a category that included Silverados only?
I went to high school in Japan for a year. Something that tripped me up for a while is the gesture for "come here". It's equivalent to the English gesture for "go away". (Try gesturing "go away" like you're shooing a bug away and "come here" like you want to tell someone a secret. Your hand flips 180 degrees, but it's basically the same gesture.)
This hack is (quite literally) worth billions of dollars. From market manipulation to geopolitical implications. So yes, 113k is peanuts.
Yeah, this could've been very bad. I don't buy that it's a test. Twitter is going to fix this. Probably it's a restriction of the exploit that you don't know the posting account or something.
Don't worry guys I just changed my password.
Twitter used to go down all the time. Just put up the fail whale for old time's sake.
Why “Mentality” Is Everything
Precisely. Tesla has said in SEC filings that @elonmusk is considered an official channel for company information.
I'm not entirely sure if modem sleep was used in that 24 hours calculation.
ProtTrans Delivers SOTA Pretrained Models for Proteins
They were talking about Twitter stock, not Tesla.
What about diversity candidates, is the "bar" lower for them? Genuinely curious.
> it's fixed with a software update

How is it fixed with a software update? Why is it running software when charging?
They are not stupid if they could make such a big attack.
Half-floats in 7nm HW, a ML dream come true.
This hack could absolutely get people killed. There are several tweets I can think of from POTUS that would begin immediate military mobilization from an unfriendly country.
They got Obama’s account too. What would happen if they got Trump’s?
What's the logic? It makes the problem much more visible. Ostensibly the fix for fake tweets would also fix whatever they'd be trying to cover.
It’s true. There are some common controls that are not as easy to access as you would like, but the common stuff is physically interfaced. I do think they took the design principle of avoiding physical controls a little too far, but in general it is the most fun and interesting car we have owned. Anecdotally, it is different enough that my 65 year old mother in law doesn’t drive it because she is not comfortable with it.
You're right - a society without scientific method or future-orientation will not develop industry and technology to the same extent.

But note how your question presupposes that competition is the only viable form of coexistence - or, at least, the only one that matters. But competition only occurs when at least one of the participants is acting competitively (i.e. treats the whole thing as a zero-sum game with winners and losers). If all players decide to collaborate, or even simply to coexist, why would a conscious choice resulting in a lesser degree of technological development be considered problematic? And if it's not problematic in that hypothetical arrangement, then what is the actual source of the problem IRL?
Or just posted some spirit-cooking pizzagate nonsense as Bill Gates.
This hack isn't going to generate millions for the attackers. But you're right that it was still outweigh any bug bounty
> multi-factor authentication enabled

It sure seems like multi-factor auth isn't very helpful, when nearly all hacks have nothing to do with breaking credentials.
I have a couple of services that run on twitter API and they have all been suspended in the last half hour. They are definitely in damage control mode.
> LuaJIT is still at Lua 5.1, IIRC

It's 5.1 plus some of 5.2.
1) If I was just trying to make money - some market manipulation experiment (most likely just Elon Musk since TSLA would be easier to hide activity)

2) Donation matching similar to this hack, but posting a collection of nonprofits around the world

3) Wanted to create chaos - some anti-China, anti-Trump, or anti-cancel culture tweet by popular figures

4) A message of unity - "Stand with humanity" or something with everyone simultaneously posting.
This is what happens when you put all of your communication eggs into a single basket.

Twitter needed to be taken down a couple of pegs. I think accounts of a high enough profile may want to closely examine the ActivityPub ecosystem.
Having a complete and accurate map is important for researchers who study the X-chromosome.

Long sequences reads allowed them to map the highly repetitive chromosome. Most sequencing is done by high-throughput short reads.

The technology can theoretically be used to map other regions of the genome which are highly repetitive.
Debian aarch64 port rootfs + custom kernel. That's how I run Arch Linux ARM on PinePhone.

There's really nothing else that's needed other than the kernel to make any aarch64 distro run on the phone.
They are somewhat right. I have built these feature flag/kill switch kind of things and they rarely get tested. Over time it might not even work or have other side effects.

On the other hand, a product like Twitter having some content moderation filter seems very likely.
Instead of putting so much engineering time into pushing a political agenda, twitter should focus on security and identity improvements.
That would be so incredibly stupid. Burning a money machine of that magnitude for lulz? I don't think anyone would do that.
Coinbase apparently did also: https://news.ycombinator.com/item?id=23852054

I'm betting Gemini also blacklisted that BTC address, especially considering that they were in the first wave of fake tweets.

Really wondering now just how much BTC the attacker effectively left on the table by reusing a single wallet address, especially considering that lots of people who deal in crypto use just a handful of exchanges to send it. Would be pretty difficult to quantify, though.