skysight-inc/HackerNews huggingface dataset:
I wouldn't necessarily want the stock of a company that I just found a critical vulnerability with.
IANAL either but the images from the Hubble have “artistic” work that goes into them just like a landscape photograph does.

Choices like the the framing, color saturation levels, etc.
You’re off by an order of magnitude. More than 30 of the roughly 900 workers employed during the seven-year cleanup of the nation’s largest manmade environmental disaster are dead (https://www.knoxnews.com/story/news/crime/2018/12/22/kingsto...)

As stated that not that unusual. At 45 a man has a 0.3285% chance of death per year at 55 that bumps to 0.7766%. https://www.ssa.gov/oact/STATS/table4c6.html 3 deaths per year out of 900 works out to 0.3333%. So, depending on the age of workers that’s anything for fairly normal to low.
Your position is more or less defensible, but you will have to accept some compromises to your description of the universe that most physicists find untenable.

Actually, it is Bell's Theorem / Inequality and related experiments that are relevant here. https://en.wikipedia.org/wiki/Bell%27s_theorem

These experiments were really the nail in the coffin for Einstein's position for most physicists. Having to admit non-local hidden variables is a pretty distasteful result.
Obama enriched himself off his position with paid speeches and book deals. Is that as bad as whatever Trump is doing? No, which is kind of the point!
Yes, I suppose I mean regardless of law. Although I wasn't looking at it like that, I was just looking at it from a practical perspective: "he is claiming that only banks create money - well here is a counterexample where a non bank made money".

The reason I attacked Werner's article is that he mystifies money creation and perpetuates the misconception that banks' ability to create money is similar to central banks' ability to create money (he does not directly say so, but a non expert reader is likely to gain this misunderstanding when he uses terms like "fairy dust" etc.).

In the article I attacked 2 specific claims of Werner. One was patently false. The other was correct due to a technicality only.
You’re right. We should continue warming the planet while waiting for the pipe dream that is full renewables.

After all, perfect is the worst enemy of good.
There's certainly a lot of good background information here, but the basic answer of:

"In 1592, Parliament set about determining the length of the mile and decided that each one should be made up of eight furlongs. Since a furlong was 660 feet, we ended up with a 5,280-foot mile." [1]

Still seems right. Is there a nuance I'm missing that makes this more complicated?

[1] https://www.mentalfloss.com/article/25108/why-are-there-5280....

Edit: Please note I'm not trying to be snarky. It just seems straightforward to me, so I'm trying to understand the long rant.
They only need to pay out as much as is necessary to incentivize you to be upfront and report it in private rather than starting a media fuss around it (you get fame and $0) or exploiting the bug yourself (you might get a jail term). Compared to these alternatives, $50K and a clean record isn't a bad deal.
If you look at adversarial machine learning you'll see it is shaping up as a bit of an evolutionary battle. It is quite likely that a years-offline Telsa (or similar) could be deceived into a fatal collision.

We need safe updates with transparent documentation as to all the changes, with hardware enforced feature switches. Forcing them to go through an approval process doesn't sound bad until you've met regulators like the FAA -- or Apple.
What was the half-life on that vulnerability? From the moment Lastpass wrote whatever the fix was to the point at which attackers can no longer exploit it afresh, how much time elapses? If it's a serverside fix, so that the number is something like "a day or so while it's deployed", that's your answer about why nobody is outbidding Lastpass for this bug.
This game has many, many regional names. I heard it called "smear the queer" but we usually called it other names.

It's semi-interesting, though, that the "queer" was the one with the ball.

It took serious guts to be the "queer" for any length of time - after all, it was you vs. everybody else trying to tackle you. The kids who spent the most time with the ball were the fastest, toughest kids. So "queer" was a slur but also, the "queer" was the fast/strong/brave one.

Of course, there are many regional variations. It sounds like in some places, there was no ball involved, and "smear the queer" was just a name for an ass-beating.

I detest this slur now, and I hate that I used to use words like that as jokes/insults. Today I would be fighting alongside my gay friends against folks using those words.
> We will not be able to "defeat" climate change and keep this planet inhabitable for future generations without mass adoption of nuclear power.

I hope not. Current nuclear technologies are outrageously expensive. It made sense in the 50's-70's only because it was being effectively subsidized by the defense industry who needed the excess breeder capacity for bombs.

It's safe. It's fine. It's good that the democrats have dropped what was always effectively a luddite plank from their platform. But it's not going to save us absent some really disruptive new technology.

Right now we should be putting our electricity investment into straightforward, cheap and easily scaled renewables. That is what is going to replace coal and gas in the short term.

Long term? Fine. If nuclear can make the balance sheet work then let's do that. If not, meh.
On the opposite end of the spectrum, I worked somewhere that avoided reimaging PCs at all costs. Every system had tens of random workarounds applied to 'fix' issues as quickly as possible. Nothing was consistent, and IT also had a very poor reputation.
How long do you think it takes for someone to find an exploit? Sure, a long time ago I found problems in web pages by clicking "view source" and going "I wonder what happens if.." and doing POST/GET with a huge buffer, or with "\");...." embedded in it.

These days companies that take their security seriously are hopefully harder to exploit. If it takes someone a couple months of slow fuzzing/etc to find an exploit that is probably below market for the persons skills here in the US.

Maybe a part of these bug bounties should be not only how critical the bug is, but some metric of how much work the individual put in before finding the problem.
As someone who’d already been a bit worried about future mass-car hacks, I found the zombie car hacking sequence in 2017's "The Fate of the Furious" particularly terrifying to see in the theater. Rewatching it now, it actually looks somewhat tame compared to what might be since the hacked cars only inflict property damage, not injury.

> Villainess: I want every with chip with a 0-day exploit in a two mile radius around that motorcade now.

> Computer guy: There's over a thousand of 'em

> Villainess: Hack ‘em all. It’s zombie time.

> [zombie cars drive around causing mayhem]

https://www.youtube.com/watch?v=TQmMnRQu9YQ
Well they can start by not punishing us with higher tax rates just for receiving short-time work benefits: https://www.thelocal.de/20200720/why-people-on-kurzarbeit-ne...
> Not keeping your interviewer engaged

Ugh. I'm going through the interview process right now and this peeves me so much

The presumption that I, the supplicant, need to be interesting and keep the interviewer, who has deigned to give me 30 minutes of their time (often 23 minutes because, "sorry I'm late but I also have a hard stop at the top of the hour") "engaged" makes the interview so lopsided, awkward, and just nonproductive

That being said:
> Not preparing for the interview

Is completely legit. I have walked out of a couple of interviews wishing I had prepped a little bit more so that I could make the conversation a productive one
Then you wouldn't want the stock of any tech companies, because people find critical vulnerabilities in all of them.
I think that's a clever bit by Douglas Adams, and there's some truth to it in some contexts, but I hate to see it voted to the top on HN specifically.

The reason is that our industry right now doesn't make a secret about widespread, accepted ageism. And a common talking-point defense of it is "not learning new technologies".
I've noticed a lot of older software engineers seem to avoid anything "smart", and quite a few of them are into vintage cars too. I don't think that's coincidental; my daily driver is approaching 50, and completely lacks any computer or electronics for its main purpose.
the article is about finding the specific version and path
I remember seeing it in the early 2000's, so yeah.
Did you hear about what eBay execs did?
Covid Is Accelerating a Global Censorship Crisis
Christopher Mills' winning entry for the 25th IOCCC (2018) is a PDP-11 emulator. Included with the BSD 2.9 image is the mullender.c entry -- you can compile and run it.

<https://ioccc.org/2018/mills/hint.html>
DeWalt is just another brand owned by Stanley Black & Decker https://www.stanleyblackanddecker.com/

Makita is a standalone company that doesn't have a stable of brands (although potentially some OEM?).

See https://pressurewashr.com/tool-industry-behemoths/ for lists of brands owned by parent companies.

Not saying that you can't judge by the "brand"; just saying that many people are unaware that many brands are somewhat cosmetic...
Have you talked to anyone who is familiar with Qanon (e.g. investigative reporter, member, etc.)? They believe they are exposing wicked people in high places behind human trafficking rings. I don't think anyone would admit to being a 'servile Trump worshipper', neither a 'servile <insert political figure> worshipper'. Whether they are on to something is another issue. I am not part of Qanon, but I know characterizations such as yours are just wrong.

You really believe Trump is a traitor? Can you name 1 or more specific pieces of evidence? I do not think Trump is a traitor, in fact I think he has been a great president by his merits (in 2016 I was neutral). I love how he talks about specific issues and solutions rather than vague platitudes. He is a breath of fresh air, and that is why he was voted for (though I did not see this in 2016). If he is a traitor, I would love to be enlightened of this and obviously I would not support him. I think most people (such as yourself) don't spend time looking into the claims by his political opponents that he is a traitor. Also, if you support Trump you risk being fired.
We probably need to stop having these threads, because they're repetitive, usually pretty ill-informed, and prevent us from having discussions about the vulnerabilities themselves. All we do is recapitulate the same tedious discussion about how bounty prices work. That's fine, but maybe we should only have those discussions on stories about bug bounties, not any story where a bounty makes an appearance.

For the moment, rather than re-having this discussion, we can just note that bounty prices are what they are, and that no tech firm pays "existential" rates for new vulnerabilities (except, perhaps, Uber, where literally everyone involved in that story is now in the federal criminal court system).
Someone could be sociopathic enough to cause the crashes, but still prefer the money. It definitely seems like you could negotiate for more if you can play the part of that sociopath and don't mind a little bit of extortion.
Thrilling Fashion brands that have existed over 70yrs
You can always take the $50K and buy Tesla stock with it. How is it any different?
Public confidence is priceless in the automative space. The risk of bleedover onto the market segment as a whole would make that an incredibly risky (read: stupid) stunt for a competitor to pull, not to mention the legal and reputational risk if they're discovered.
Lembrary: A multiplayer persistent Haskell REPL
This change is good for Facebook. When it plays out that way they just don't want to get blamed for it.

A lot of articles seem to think Facebook won't be able to monetize you anymore. Far from the case. Within their apps -- the Facebook app, Instagram -- where they make most of their profit, there won't be any change. They don't need anything like IDFA because you're signed in.

What this will hurt is the ROI on non-Facebook apps. Publishers will get less money & advertisers will see less return.

So where will those dollars start to shift to?

Facebook.
Ah, crypto markets are big enough to accomodate their needs via mining now.
In my case, gaming taught me to type quickly, and keyboarding class taught me to type well.

That being said, my keyboarding class included copying out bodies of text as well, not just patterns on loop (There certainly was that though).
If it makes you feel any better, I'm a senior enrolled in a Maine high school right now and there's very little homophobia. In fact, a not-insignificant amount of the school is queer. Growing up I only ever heard "gay" used as an insult on-line. Times seem to have changed, and for the better!
> Neither the US not UK has built and finished a new nuclear plant in 40 years, and the single one (1) in progress in the UK is a 15-20 year project with a construction cost of £23Bn and a subsidy of £50Bn.

This is a great point and its why we should urgently be analyzing the failures of new nuclear projects to understand what’s going wrong and why we can’t do something that we could do in the 1960s and 1970s without issue (France nuclearized its power sector in less than 2 decades!)
So it's from government regulation!
Well, the standard measurements were destroyed in the fire of 1834, so that probably affected the distance a bit.
A good craftsperson can produce amazing output with mediocre tools.

A poor craftsperson will still produce shit regardless of how good their tools are.
I have been working to improve the usability for this years winning entries. For some entries it doesn't work well to "inline" the C code.
Yet this person did the right thing anyway and reported the vulnerability responsibly. So seemingly the level of the bounty was reasonable enough that it worked as intended, and a much higher bounty would have been a waste of money for Tesla.

I think the high likelihood of being caught and going to prison is also already a pretty big deterrent for people. Just think of all the challenges of actually pulling a hack like this off without being caught. For one thing, just the poking around that led to the discovery of the vulnerability has probably already logged a bunch of potentially suspicious activity linked to this guy's VIN number. So even if he sold it to someone else who did the hack he could probably be caught already. If he tried to orchestrate the hack himself, not only does he need to not be caught directly, but he'd also have to make a very large, very suspicious short trade right before the hack without it being traced back to him. Plus there's always a possibility that Tesla would have been able to lock him out quickly anyway or had some other kind of rate-limiting or other measures in place to prevent significant damage, or that even if he pulled off the hack perfectly the stock price wouldn't drop as much as expected.
Just a quick addendum -- there's a ton more than this; what I've posted is the proverbial tip of the iceberg...

I previously posted that I would write an additional post to address all of your points, but I think that on HN, for this article, for the orginal subject posted on, it goes too much off topic.

But that being said -- I would address all of your points if you emailed me: peter.d.sherman@gmail.com
There are plenty of countermeasures, but they're all active countermeasures - ex. a couple guys with shotguns, trained falcons, or your own anti-drone drones.
Anecdotal, but even as kids in the early 80s we understood "queer" was "gay" and therefore "bad."

(I absolutely hate that this was ever the case! Wish I had a clue back then)

There was no literal gay element to the game (in our town) but it was still a very hateful name for the game. The message was clear: when you had the ball, you were "queer" and therefore the bad guy and so therefore everybody chased you.

That said, we typically called the game by other names. It had a different name in every town and neighborhood, it seemed. I think we only called it "smear the queer" when we were trying to explain it to kids from elsewhere... it was called "roughie-up" where we lived, but that was apparently hyperlocal, so if the kid was from out of town he might have known it as "smear the queer."
uBlock.
zsh doesn't use "what" strings? well there goes that idea.
Imagine a ransomware attack against these jokers.
Props to you for realizing that. That's a good move you took, I feel not many would do the same, sadly.
Only way to overcome this great filter is by adopting policies that provide equal opportunities to each member of the species and create a non-divisive/united society where everyone practically helps each other

How does this utopian ideal address the lone nutcase who would actually do something like destroy an entire city if he could? The Unabomber wasn't standing up for BLM or fighting income inequality, you know.
My experience eating at hole-in-the-wall restaurants in Shanghai is that they put the menu up on a big board on the wall where everyone can see it. That tier of restaurant doesn't give you an individual menu. So the number of items is limited. You don't order a permutation of options; they list options and you order one of those. Some things come in multiple options (e.g. 孜然牛肉盖浇饭 "cumin beef served over a bed of rice", if present, is likely listed alongside 孜然羊肉盖浇饭 "cumin goat served over a bed of rice"), but those are just separate (adjacent) entries on the menu, not a "pick your meat" kind of thing.
> Have coal or gas plants ever created a Chernobyl-style exclusion zone?

https://en.wikipedia.org/wiki/Centralia_mine_fire

Maybe not a Chernobyl-style exclusion zone, but its devastating a town and the fire will be ongoing for 250-years.
I believe you misunderstood my comment (perhaps I worded it poorly): I intended that it be interpreted as a statement purely within the meta-discussion. I shared a concern about the arguments used to justify both sides of the debate, and did not intend to advance one side or the other.

While you seem to believe I was arguing against preventative burns, the sibling comment seems to believe I was arguing for preventative burns which are (according to that comment) a crazy libertarian idea. This makes me wonder whether any critique of dogma must be reinterpreted as a disagreement about facts as a kind of memetic camouflage self-defense mechanism...
When you sell to the bad guys you have to factor in the risk-price of 20 years in the US prison system.

Bounty payers enjoy a hefty discount when they waive their right to prosecute.
Public opinion on same-sex marriage changed very quickly from 2008 to 2016. Obama opposed same sex marriage in 2008 and didn’t really support it until after the 2012 election.

And I'm not sure it's totally accurate to say that what happened was people coming around to "lefty liberalism." The nature of the debate changed quite significantly after 2005. First, it became clear to the public that sexual orientation was an immutable characteristic. When I was growing up in the 1990s, it was still common to hear it called a "lifestyle" implying it was a choice. Second, there was an increased focus on equal legal rights for committed same-sex couples. Appealing to neutral application of universal legal principles is usually a compelling message for even non-lefty Americans. Around the same time as Prop 8 was passed, a state Supreme Court decision legalized same-sex marriage in Iowa. Iowans aren't particularly lefty, but a slim plurality supported the decision within a year or two. Third, in the same timeframe a number of mainline Protestant churches began ordaining gay clergy. While the political influence of these denominations is less than in the past, they’re still a powerful force in the center of the political spectrum among middle age and older Americans.

The end result of all that was Obergefell which wasn't particularly lefty or liberal. Justice Kennedy's opinion was a paean to marriage as an ancient and essential social institution. Because marriage was fundamental, participation in it could not be denied to same-sex couples just because of the programming they were born with.

Of course, none of this would've happened without decades of tireless "lefty liberal" advocacy. But public opinion changed dramatically within a single decade, and wasn't accompanied a similarly large leftward shift in peoples' politics generally. So it's interesting to think about what drove those changes.
reminds me of the article about how to quit vim https://github.com/hakluke/how-to-exit-vim
I'm pretty sure there are lots of people in the industry who write unmaintainable code on purpose for their own job security. I don't endorse this, but I've heard horror stories at several well-known companies about instances of this.
Marginally related: In 2020, the United States finally decided to adopt the International Foot (1959, 304.8 mm, based on the 914.4 mm yard / 25.4 mm inch) for land surveying, which is already the standard that's followed in all engineering disciplines apart from surveying. Now the historical US Survey Foot (1893) will soon been abolished for good.

It's an interesting piece of news, but due to its horrible title, it'll probably never be voted to the homepage (a better title to me would be "The United States finally adopts International Foot, abolishes survey foot").

* America Has Two Feet. It’s About to Lose One of Them

https://news.ycombinator.com/item?id=24196228
> a single determined person can destroy an entire city

That's already true, and has been for a while, if you count medical doctors with a reasonable degree of connectedness.
I get that it doesn't seem to make a lot of sense, but is there some market principle that can be used to explain why so many companies act as they do, and that it is in fact rational? Must it be a black swan fallacy?
> Have coal or gas plants ever created a Chernobyl-style exclusion zone?

https://en.wikipedia.org/wiki/Centralia_mine_fire
Girl thrown into air by kite in Taiwan
It really is. I came to this realization on the way back from a robotics competition, I was editing pictures I took with my new camera. I was reading articles about improvements we could make to SLAM, and editing pictures I took on the trip. When I realized that I had so much dynamic range that was able to completely remove haze and flaring from incredibly bright objects very close with a very middling lens, and combining that with the very impressive results in optical SLAM, it certainly gave me pause. Since then I've done quite a bit of research on this and I haven't been able to find any kind of usable countermeasure.

Hanging out on photographers forums, there's people who have been able to edit out details by substracting up to seven stops, with current consumer tech and optics, and improvements are coming every few months. Canon just demonstrated a sensor with 20 stops of dynamic range. Coupled with IR sensors, far UV sensors, and different wavelength filters to filter out lasers, there's really not much that can be done anymore. Except for kinetic or directed energy approaches, but they are incredibly expensive and incredibly vulnerable to saturation.
Sure there was. Remember cartridges for the game consoles? Or the clipper chip? (mostly about data but still a central form of control) Or HDCP. Or CSME which has PAVP. AGESA has a similar thing. Or the ACM validated by the ROM in all Intel CPUs. You can't even load an OS before you get it allowed by them.

I think you meant to say: not directly visible by the user at the scale in terms of single-vendor profits. But that's a different thing which needs different treatment. Either antitrust laws or new laws will have something to say about that, because it boils down to 'power' that is currently legal as-is.

You can be emotional about it, but that doesn't help the discussion.