skysight-inc/HackerNews huggingface dataset:
Those people who have trouble producing acceptable documentation to the state, but are citizens, generally aren't being deported though. And citizens who can't prove their identity to vote certainly aren't having their non-existent drivers license shared by states.

So what part of the events described in the article are about "shaping the electorate"?
Great work John. I have about 500 students learning programming remotely and have been looking for better remote presence alternatives. So far the issue is that other products reinventing the wheel are more resource intensive than Zoom (machine, internet). Working on top of Zoom is much smarter.

I know it's early, but my only other obstacle is that those students are mostly Windows or Ubuntu :/ Although I totally understand focusing on MacOS
That's only safer from attacks that bypass the public admin portal authentication. Any social engineering attack that steals credentials directly won't be impacted.
A Visual Guide to Reversing a Linked List
Of course she had, she believed she was doing God's work.
Sometimes it seems things change quickly online, sometimes not so quickly.

It’s been about 20 years since we built “broadband activated merchandising” (aka “BAM”) for selling wrestling hats and t-shirts at scale to millions of viewers, contextually triggered along side WWE live event video streams:

A system and method for enhancing electronic commerce and/or communicating information concerning products and/or services in connection with multimedia (e.g., video) transmission and delivery is provided. The system and method facilitate targeted marketing and/or merchandising in connection with video streams delivered to users across a computer network, e.g., the Internet and/or the World Wide Web, by synchronizing ancillary content with the video stream. The method/system may be used in a broad range of applications for live, taped live and on-demand video streams.

https://patents.google.com/patent/US20020019978A1/en

In your 640 or 800 px wide browser window, beside the live stream (320x240 at 700 kbps, ahem!), you had a product pane showing contextual offers you could add to your cart, and then check out when the event was over.

The stream metadata was fed by a producer watching the live action and using a e-commerce store event dashboard to choose what products to promote when.

For comparison, from this AWS article:

The team have added the ability to send timed metadata along with the video so that you can fire events in your application at crucial points in the live stream... you can build experiences that create a more valuable relationship with your viewers on your own websites and applications. For example, if you were live-streaming a product launch, you could synchronize additional product information to be displayed as new products appear in the video. You could even show a buy now button that allows viewers to purchase the exact product they are watching at that moment on the live-stream.

Pretty cool to see this descendant!
Bottle Cap Thread Calculator
I thought it was just me, but yes... please send me your ISK and I will double it... here's a website with a wallet thing that shows we sent out money... everytime we received some.
How much do you think Trump's DMs are worth? Kanye's? Elon's?
Isn't the whole point of Terms of Service to protect against being sued in the event of these kind of instances?
Wonderful fey footnote about the word "fok" and "fokking" -All my WWII escape books from this era have solders saying "mucking hell" for much the same reasons...
me = ditto - (best shape of my life)
The Vice article (https://news.ycombinator.com/item?id=23853786) was recently updated with a note that the Twitter insider was paid to help take over the accounts, which raises further questions on the nature of "social engineering":

> we spoke to two hackers and we were able to independently verify they were in control of hijacked accounts today. One of them said they paid the Twitter employee to help them take over accounts; not sure on the specifics here at the moment

https://twitter.com/jason_koebler/status/1283594885292077056
Curiously with preference stacks we're relatively close to scenario 1 today in private financing. It would be interesting if employees were granted bonds for early stage work. This would enable the company to defer payout to a future date when the company is presumably more profitable, and employees some stability/protection for the value of the deferred compensation.
Smaller Nodes, Much Bigger Problems
This is good for bitcoin - /r/bitcoin probably.
No need to send anything. Just sign a message with the corresponding private key.
To me, it seems a little weird they can tweet on behalf of a user. Especially a user with 2FA on their account.

Curious as to what types of changes might come out of this going forward
>However, why expose yourself if you can get in and out of these accounts and collect the info. I'm not sure I buy the diversion explanation.

Perhaps they felt as though they already had everything they needed and didn't mind ending their access? That would be weird, though, because I imagine long-term, continued access to DMs would likely be more valuable than just cutting out now.
People ask all the time: to enter certain buildings, when using a credit card (in almost every case that’s a violation of the card-merchant agreement). Entering bars and clubs or picking up liquor or some prescriptions (not even my prescriptions!). For many bars and clubs and at, say Walgreens for liquor they don’t merely look but swipe...and in the bars the info is collected by the company that makes the swipe system (learned of this from a HN post, though I could of guessed). What business is it of theirs where I go?

I never hassle anyone — they didn’t make the rule. I just say I don’t have one and invariably to date (except entering a federal court house) I’ve been fine.

This includes flying. It’ll be interesting to see if that “real ID” rubbish does finally get enforced. All the previous deadlines have been punted.
Filter bubbles are a feature, not a bug. Having an online presence is too unsafe for too many people. If you have a better idea of how to solve that problem, I'm all ears.
Which shows that Twitter probably doesn't properly employ 2FA and two-person-principle when dealing with high-profile accounts. Otherwise, social engineering would have been almost impossible.
Well, it is encrypted with a pin. Unless you make a long pin or switch to optional alphanumeric, the contact list is just protected by SGX and a short pin.

The SGX works like the iPhone auto-wipe. But it is in an online service with lots of juicy data in one place, so the target is bigger. A vulnerability could leak your contact list.
One can trade data navigability and a performance hit for opacity of content.

Encrypted rows of data are meaningless to an "admin" that can query to its heart's content but will never be able to decrypt the result set. On the other hand, the layers on top (such as the web-tier that emits the plaintext) may have the keys to decrypt, but lack the privs to run around in the database; from that level, they must pass along the user's credentials to obtain user specific content.

Since people don't search by content on Twitter (afaik) and only 'meta-data' indexes are used (such as hash-tags, follower, following, date) this is entirely doable for something like Twitter.

There is also 'Homomorphic Encryption', but I'm not sure the tech there has reached acceptable performance levels.
Judging by Trump was one of the few that wasn't hacked, presumably there are some extra controls in place for that account.
I think the bigger error is that they keep calling it a fundamental structure. It was my understanding that this structure is very much an emergent property and nothing fundamental.
This seems to be a large part of the business model though. A platform play only needs to get you in the door and hooked on the almost-great bit of the platform you needed.

They win when the first comment in any technical-requirements-finding session is "well AWS has <X>... that could work?".

New companies choose AWS almost by default these days, and the alphabet soup of services available means that it's got an answer for just about any paradigm you're interested in, which means there's no reason to leave.

The proliferation of half-baked services at AWS will never end. They won't become fully baked either, because that doesn't make business sense -- doing just enough to capture new business is most efficient, and in the worst case just let some partner build on your platform and offer their services.
I'm guessing you work/have recently worked at a big tech company (FANG or one of the ~5 other companies of comparable size) and are seriously overestimating how common their best practices are. Unless by "passing grades as an undergraduate" you mean "bonuses and promotions at a majority of the companies that handle your data every day"
i really want to help beta test this!
> The accounts were posting for hours after it seemed Twitter became aware what was going on.

Oddly, it was just Elon Musk's account that had multiple tweets over a long period of time. The other accounts did just one.
When you say unannounced pentester, how the hell did that happen? Usually, isn't someone in the escalation chain aware of these types of things?
Once a public official leaves office twitter should remove all followers to zero.
Commercial airliners vary in size more than an order of magnitude anyway. There are commercial aircraft that are shorter than an A380 is tall.
A wallet is really just a public/private key pair. To prove you have access, you can just sign a message of someone else’s choosing with the private key. No need to transfer any value.

It’s why any claims to be Satoshi are laughable. If you want to go public, just prove it cryptographically.
Dumb question: is there a x_chromosome.txt with the sequence in order? Why do geneticists not talk about it this way?
I don't get how it can cost so much, and also how YouTube or Twitch would let you stream for free. They can't be making that much money off a stream, can they?

A 10 hour stream viewed by 20,000 people... My recollection of YouTube is that they pay the creator approximately a dollar per thousand views, if that's a third of what they make, then they make 3 dollars per thousand views. Assume YouTube counts a view as ten minutes, so 200k hours of streaming would be 1,200,000 views (200k hours to minutes / 10) would be (120*3) 3,600 dollars?

Something seems off by an order of magnitude. Is the markup that high? Did I make a calculating mistake?
FBI warned a non-profit 8 hours before news broke that the US had bombed an Iranian general. Indeed, they saved many lives.
Paolo Bacigalupi's shipbreaker novels and The Windup Girl take place in a post-oil future with fleets of high-tech clipper ships. The ships transport freight and people around the world using high-altitude kite-like sails.
Yep, there's no true reference frame in the universe - Einstein realized that more than 100 years ago and put it down as the theory of relativity.
First Coronavirus Vaccine Tested in Humans Shows Early Promise
The whole book is hair raising and hilarious but the very end when they run into Thesiger is unforgettable.
> OK, what about the people who have physical access?

What about them? Nothing about physical presence should lead to userdata access, nor the ability to act as users, if the application-layer security is squared away. In any case, physical security is by far the easiest of these topics to handle. Keeping people out of buildings is a human undertaking with 1000s of years of solid doctrine.

> Who watches the init daemon?

Another important question! If you don't know what's running on your box, you really don't have a security story at all.

https://cloud.google.com/blog/products/gcp/titan-in-depth-se...
> social engineering

had that feeling... wonder how much more vulnerable working from home is making us to such things.

also scary that targeted employees with such level of access fell for it. must have been really sophisticated.
The account was vandalized in the past by a rogue employee, they probably added more controls since then.
I find it hard to believe this was a Social Engineering based attack. Elon Musk’s account was accessed multiple times after their tweets being deleted and it seemed to last forever, account by account being taken over.
I've never had this prep for interviewing people.

Most of the time you see the resume a few days before. They may say a few things "don't say this don't say that". (hr)

Most companies take the rejection as a point of pride. "We've rejected 100s of candidates."
business deal gone bad. one simply does not start a business in Nigeria without paying local gangs first.
It’s another layer of defense. Someone has to not only know your credentials but also know how to use them to get to the jump host, and from the jump host know what to do next (although unless it’s ephemeral, there are probably enough bread crumbs to find the proper url).
hopefully not enforceable
The point of having a made up name that has nothing to do with the thing it is about is that it makes defending a trademark easier.
> The goal isn't to maximize the value of black lives, but to bring parity to white lives. Maximizing the value of black lives is a very different position.

Fair. Though they are effectively the same until parity is reached.

> I would agree, but (at least if you take the systemic view of racial injustice that I do) the long term impacts of things like incarceration due to the inconsistent enforcement of petty drug charges do have far reaching consequences that make other kinds of change difficult to consider/analyze.

And here we are back at (hypothetical) differences over our respective understanding of the situation, particularly in comparing the social impacts of drug use and incarceration. I still don’t think any difference in values is necessarily implied.
Snoop – a tiny JavaScript library for test spies
For those of us looking to move away from heavy-handed JS testing libraries (big APIs, huge `node_modules` graphs, etc.) like Jest, Mocha, Jasmine, and Sinon - here's a small, modular piece to add to your JS testing toolbelt.

snoop - Easy breezy test spies fo sheezy.

Recommend to use with the absolutely wonderful uvu - https://github.com/lukeed/uvu.

See: https://twitter.com/lukeed05/status/1283378348970762240
I see what you are saying, I know SMTP fairly well, used to run my own server, and looked fairly deeply at DKIM / SPF / DMARC. However I also know blockchain protocols intimately, and I can say with certainty that the Bitcoin protocol and SMTP are completely different (as well as Ethereum, Monero, Stellar, Ripple, EOS, Tron, and on and on). It is just a completely different thing.

If you are worried about other wallets not accepting "my" wallet, as is the typical problem with hosting your own email, you don't need to worry. Money is money, if I receive it I receive it. It's just completely different from receiving a text-based message like the wide-open and free SMTP is.
The incentives encourage people to downvote rather than criticise. If they post a critical response, they run the risk of being downvoted by those who disagree with that criticism. You can't get downvoted for a silent downvote.
Amazon extends work from home policy to January 2021
> Once we became aware of the incident, we immediately locked down the affected accounts and removed Tweets posted by the attackers.

This must be some new meaning of the word 'immediately' that I wasn't previously aware of. It took them quite a while to get these accounts locked.
Sorry, that's not quite what I had in mind. I was considering the feasibility of modifying LuaJIT to directly target a different language.

The projects you link to all either compile to, or are written in, Lua source code or LuaJIT bytecode. That's less efficient than retargeting the LuaJIT VM. For example, LuaJIT includes bytecode instructions specifically tailored to Lua tables. It looks like these projects build, say, their array data structures on top of those existing instructions, rather than adding array-specific support to LuaJIT.
Epic's statement at the time:

>“After 18 months of operating Fortnite on Android outside of the Google Play Store, we’ve come to a basic realization,” reads Epic’s statement. “Google puts software downloadable outside of Google Play at a disadvantage, through technical and business measures such as scary, repetitive security pop-ups for downloaded and updated software, restrictive manufacturer and carrier agreements and dealings, Google public relations characterizing third party software sources as malware, and new efforts such as Google Play Protect to outright block software obtained outside the Google Play store.”

https://www.theverge.com/2020/4/21/21229943/epic-games-fortn...
Echoing this request -- knowing this stuff also helps make sense of seemingly bizarre parts of the system.
More likely a password reset to take over the account. After that an attacker can just tweet from any standard client.
> It’s as suited as the F-16

That's also a problem, since we’re talking about it's core mission where it's supposed to be a more capable replacement for the F-16, and is several times as expensive (both initially and per flight hour).
How is Solar Panel Street Lights more reliable?
Occam's razor says this is almost certainly the case. It isn't like the hacker knew that it would generate such little bitcoin being sent their way until after it failed.

Especially if the hacker is not from the US it seems much easier to do the bitcoin hack than try to contact a company thousands of miles away that you know one at.
In the screenshots of the admin panel, it looks like they have blacklists of things that shouldn't show up in searches or on trending. It's not clear if it's accounts, or some other criteria that's blacklisted though.
This makes a lot more sense. I can't imagine Twitter isn't using some sort of phsyical 2FA like yubikeys which are virtually Phish proof if implemented well.

That being said, what was the employee's endgame here?
I am highly curious about two questions that a physicist or a cosmologist could maybe answer...

1) What do we actually know about these "structures", and fundamentally how certain are we that they have any consequence whatsoever to our understanding of the universe? Is it possible that the patterns we notice are just us being humans noticing patterns in randomly generated white noise?

2) Could there be emergent behaviours at the super-astronomical scale where just like electrons and protons and other elementary particles combine to all sorts of emergent higher order behaviour in atoms and elements, could there be similar outcomes at the multi-galaxy-cluster scale that would be impossible to observe at the human scale?
Beyond the Information Age and into the Useful Knowledge Age
I must have tried ~15 or 20 times to quit. I mean really, going at least a week without smoking. I was ~1 pack a day. It stuck the last time, and it's been 5 years I think? People said you'd never stop craving it, which was true for a while. Today, I really don't think about it at all.
Can you give some examples of how life is improved by having such a system? The current US system seems excessive already.
There's always someone, usually many people, with abilities like this for any service that's automated enough. Even for banks, as much as they might try to separate portions and mitigate access. The solution is not making it impossible, it's making it easy to find out if it was done and being very careful who you put in those roles. That's just the nature of the world.
If you need to search a personal wiki can help. I run one in a docker container. No real organisation just a few good keywords and I can normally search for the thing I wanted.
If nothing else, they'll get sued for securities fraud by some shareholders, because as Matt Levine likes to say, everything is securities fraud.
It doesn’t make sense and is wrong. Kind of like the Westboro Baptist church protesting funerals is wrong.

Not sure there’s anything to really do about it in a free society though. All the talk about cancel culture doesn’t seem to propose any solution.
I’m frankly astonished that “driving licenses” have so much info in them.

If I need to attest to my ability to drive (which is quite a reasonable thing to require of people while they drive), all that is needed is photograph or fingerprint, expiration date, class of qualification and any restriction (such as glasses). None of the other info has anything to do with driving.
You get taught C++ on the job
A cursory understanding is a good starting point, even if it's not 100% technically correct. This is especially true for people who don't consider themselves mathematicians but still have to deal with quaternions or similar entities. The biggest stumbling block to understanding math (for many people) is a lack of confidence combined with feelings of frustration. If a simple video can get you over that first step, you are on a good path to developing a deeper understanding.
> The law can change tomorrow with the stroke of a pen and society won't owe them anything

What you say is literally true, but because most investment ends up as wages, such an act would literally destroy tens of billions of dollars of working capital, and put a hundred thousand people out of work overnight.

I assume that's not an outcome you actually advocate.

> Property rights arise naturally as a result of scarcity

Rubbish. The whole concept of rights is almost entirely artificial [0]. For most of history, property and other rights were determined by whoever had the biggest army. Jesus, many people still don't have the right to their own bodies in some places in the world.

The idea that rights of any kind are somehow anything other than a set of cherished beliefs codified in law, is nonsense.

> Copyleft licenses were created as a reaction against copyright.

I think the situation is much, much more complicated than that, but it is a side issue of this conversation at best.

> this appears to be an argument against copyright... The public simply prefers to be entertained

You surely can't blame people for wanting to be entertained? Are you saying you never watch something fun?

In any case, weak and misapplied copyright laws have enabled Google and Facebook, in particular, to concentrate the important elements of journalism and present it to their users in a way which reduces the diversity of all journalism. They show just enough to get away with "fair use" while ensuring that the likelihood of people clicking outside the walled garden is minimised.

Imagine what these companies would do to us if basic copyright was even weaker. Do you think Facebook would link to an article it can just copy? 2 billion+ people on the earth would have just one web browser and it would never - not be allowed - to leave fb.com.

That is not a future I want.

[0] https://en.wikipedia.org/wiki/Rights

[1] https://en.wikipedia.org/wiki/Magna_Carta
Off-topic, but I've never seen anyone describe themselves as a "devops-sceptic" - could you elaborate more on what that looks like for you?
If true, then what Twitter officially posted makes more sense.

Without this bit of information from Vice it would make what Twitter officially posted downright scary and not add any comfort factor to what the heck is really going on.
What can basketball teach me as a developer?
This is what "clean room" duplication efforts try to bypass.
I discovered that although I can draw very well I have no visual memory.
(For this reason it is actually very difficult for me to know who I'm talking to, even if I know them quite well.)
If it’s really a social engineering attack then I think it happened because everyone is working remotely and it is easier to perform social engineering attacks. Maybe this incident will have impact on their long term remote work plans.
A simple official website is enough for hosting a list of short statements.
Nah, 14yr old in the basement who stumbled upon this.