skysight-inc/HackerNews huggingface dataset:
It is. It's equally likely that the direct goal of this attack was simply to harm FireEye.
My buddies and I still have an all day LAN party once a year. It’s one of my favorite traditions. We all bring our gaming PCs and way too much junk food and just play games all day. Luckily my wife supports the idea at least enough to take the kids for the day.
I've had 5 packages this year take longer than two weeks priority. One not of those five was 40 minutes away that took 8 days to arrive. I've had stuff sit in post offices so long I had to call to make sure they weren't lost. Another item get marked delivered in a different zip code than my own, only when I opened a case was the package thrown on the ground in front of our mail box cluster. I can't tell you how many packages marked as delivered only to be delivered the next day.
OK, I still don't understand. Are you suggesting that modulating between keys was sufficiently difficult for (say) Brahms, Beethoven or Wagner that they would try to avoid it?

That seems quite contrary to my understanding.
>It will take an awful lot of hard and determined work for us to ever make Earth less hospitable than Mars

... but we're doing the best we can!
Red Hat didn't make CentOS they acquired it. This is very similar to a large corporation acquiring a smaller competitor, promising to continue supporting it, creating a new, different product using the brand, then dropping the original product.
I love the idea of a "seductive problem", one that draws you in by initially seeming simple and turning out to be deep.
Almost 2020. MuZero from DeepMind was a pretty amazing breakthrough. Single algorithm that can play Atari games, chess, go (and a variety of other board games) with super human ability.

https://deepmind.com/research/publications/Mastering-Atari-G...

It felt like a baby step towards general intelligence.
From their official blog post:

> Based on my 25 years in cyber security and responding to incidents, I’ve concluded we are witnessing an attack by a nation with top-tier offensive capabilities.

I wonder what nations possess “top-tier offensive capabilities” today. USA, China, Russia, Israel come to mind. Who else? Is there a list or metric to measure a nation’s cyber attack capabilities?
> For the love of all that is holy I sure hope that you're not missing out on free money

Care about money a little, eh?
https://www.mc.mil/CASES/CourtCalendar.aspx

Military Comissions (Tribunals) has cleared their calendar.
I have a pair of fairly premium headphones with excellent sound quality, and I also have AirPods — I actually grab the AirPods more often than my nice headphones just because of how convenient they are.

I got them for cheap, and I definitely wouldn’t pay $500 for convenience without exceptional sound quality (so I’m completely not interested in these new ones). But to say that apple’s headphones are not good is, honestly, just wrong. I love the AirPods for background music, podcasts, audiobooks, and phone calls as I go about my day. I owned a different set of wireless earbuds before the AirPods which were actually higher-quality and more expensive, but I didn’t like them nearly as much. Convenience and decent sound quality make the AirPods perfect for casual listening. Of course, still having a separate pair of actual high-end headphones for sitting down and really enjoying the detail in music in other scenarios.
This is what grsecurity has done as well and I don't understand with people that against the current grsecurity way of licensing.
Yeah, it is kind the same, but with the same page.
There is also the question of which personality does the most good for a company. I'll hope you will all forgive me if I quote myself here. At the end of my book "How To Destroy A Tech Startup In Three Easy Steps" I concluded with this thought:

----------------------------------------

If you read much of the business press, you're aware that there are two competing theories about what makes a great business leader. One theory says the leaders should be extremely aggressive psychopaths who crush all their competition. For an example of this theory, you can read almost any biography about Steve Jobs. The second theory says that humble, egoless leaders build the most successful companies, because they do the best job facilitating cooperation and communication. James Collins, in his book Good to Great, makes this case about several leaders, including Darwin E. Smith of the paper company Kimberly-Clark.

Nonetheless, we can find examples of both types of leaders succeeding. Steve Jobs was successful. So was Darwin E. Smith. Is there any way to reconcile the conflicting theories? I believe there is: simply assume that the most important quality any business leader can have is the willingness to quickly fire weak players. Therefore ruthless psychopaths damage their businesses with their pathology, but then make up for it by firing people quickly. And humble, egoless leaders help their companies with their healthy attitudes, but then undermine the business by being too slow to fire weak players.

Humble, egoless leadership, ready to fire fast — that is a rare combination. I would say that Andy Grove of Intel had that combination of traits. And of course, there is Ray Kroc of McDonald's. Due to some people's aversion to the food sold at McDonald's, the sheer brilliance of Kroc's entrepreneurship often goes unsung. But he was willing to take a risk on complete unknowns, most notably on June Martino, one of the all-time great hires in the history of USA business. At the same time, Kroc was willing to fire anyone who didn’t work out. That combination of willingness to take risks on unknowns and quickly fire any mistakes is something to which all business leaders should aspire.

How to spread awareness of what is needed in the leadership of startups?

Recently, I exchanged some email with my friend Colin Steele (currently CTO of TypeZero and formerly CTO of RoomKey.com). We discussed another startup that had failed, and he wrote:

"It's sad and disheartening. I think few people understand how amazingly difficult it is to start a new business, and run it successfully. Drama, people, and personalities, seem to have an outsized role in how these things crash and burn. There needs to be some codification of best internal practices for creating startups, like Steve Blank's book “4 Steps To The Epiphany,” but for the culture; a co-routine that runs alongside "customer development" – call it "culture development" or something."

https://www.amazon.com/Destroy-Tech-Startup-Three-Steps-eboo...
>There is no evidence that FireEye’s hacking tools have been used or that client data was stolen

Later in same article...

>Beyond the tool theft, the hackers also appeared to be interested in a subset of FireEye customers: government agencies.

??? Which is it?
Enough, but they are targeted by the authorities instead.

https://news.ycombinator.com/item?id=10101469

https://news.ycombinator.com/item?id=6946909

https://www.techdirt.com/articles/20160505/00383034349/fbi-h...
My point is that this is not a "free market". It has substantial restrictions.
> the plaintiff failed to bring the complaint up in a timely manner (i.e., before the election)

The present lawsuit addresses this argument as follows:

> Prior to the election, there was no reason to know who would win the vote in any given State.

Points for honesty, but I don't think it helps them to say this part out loud.
Intercepting an sms message for 2FA is also easy nowadays via sim cloning.
There also seems to be evidence showing you can offset a days worth of sitting with 40 minutes of sweating exercise.

https://www.sciencealert.com/getting-a-sweat-on-for-30-40-mi...
One thing that hit me is that Matlab sums arrays in a naïve order, causing unnecessary loss of precision. I’m sure there are other things that it does poorly in retrospect, but I’m no Matlab expert.
But the question is whether lying down all day is better than sitting down all day, if you already have no choice but to work all day.

As long as you're taking breaks to be active, it's not harming you the way that sitting can do great harm to your back and shoulders and neck. That's the point.
> I personally hope both San Francisco and all of California suffers fiscal collapse.

And you are surprised that the residents hate you? I dislike plenty of cities but ideating about their absolute collapse speaks a lot.
The most popular database where the number of concurrent users = 1
By not favoring or biasing. Truly.
Big fan of Chollet. Really enjoyed the paper.

Also a big fan of Hutter prize. Good AGI is lossless compression.
Learned my lesson this year, probably only lost about $6000 while waiting for the crash that never came. Even if it does, I still have made money since.

It was hard to sell and admit defeat.
yes. here is good place to start https://thecreativeham.com/the-list/
This is not even a properly disguised advertisement. Content free and full of fluff. Keep pieces like this in mind when HN as a group want to boast it is somewhat better than the other forums on the Internet. God I miss old Slashdot.
Talking about lawyers: https://news.ycombinator.com/item?id=24957200
> If the majority of those deaths were people being hit by a bus, you'd expect the 60 day number to be about double the 28 day number

Only if the testing was unrelated to the death or hospitalisation. If people who get hit by a bus are routinely tested in the ambulance or in hospital, the outcome will be more likely as reported.
Probably anyone else in the Five Eyes, especially the UK.
Definitely, may be not directly, but it lies at the heart of software engineering(or more appropriately computer science). It helps with thinking differently, for example I don’t know if ndergrad courses teach distributed search algorithms using eigen vectors and values, but it helps to understand invariants and transformations better.
> A small group of agents in the U.K. wrote to Skat between 2012 and 2015, claiming to represent hundreds of overseas entities -- including small U.S. pension funds along with firms in Malaysia and Luxembourg -- that had received dividends from Danish stocks and were entitled to tax refunds. Satisfied with the proof they received, the Danes say they handed over some $2 billion.

Yeah, sounds very legal.
> The problem in the US is that everything is aligned against making stuff here. The unions have been in damage control mode for decades, trying to avoid losing the factories that employ two hundred to the more automated factories that employ twenty, but then as a result losing 100% rather than 90% of the jobs to China.

Short-termism around corporate earnings has done more damage to U.S. industry than unions ever could. And to be clear, I don't think China is any better, despite popular (misconceived) impressions to the contrary.

> But it would imply paying more for stuff because it's not being made in a polluting sweatshop in an undemocratic country which is acting like the nation state version of a 19th century robber baron.

That's increasingly not applicable with automation as well as the plunging cost of renewable energy. There's natural gas being flared in the Dakotas because it is uneconomical to deliver it. And as I understand it both North and South Dakota are not known for an overly restrictive regulatory environment or leadership. It's more a matter of volition IMO.
Yes, it would have value in a game engine once you hit the point of having bigger memory management needs. Has a bunch of customised allocators for different kind of data that you can use to enable good performance patterns in your code.
> we started computing with dark mode

Computing with “light mode” preceded video terminals!
Interest != Used or Stolen Client Data.
Centos RIP
I guess they do it to discourage on/off subscriptions, which I get. Would be better if they gave a bonus for unbroken subscription instead.
Orthographic Media
Why not? Last mile delivery by drone has huge potential in making neighborhoods better. Less traffic, less ICE engines, faster and cheaper service, easier market entry for new operators.
> Consistent with a nation-state cyber-espionage effort, the attacker primarily sought information related to certain government customers.

If this was the primary objective of the attackers, why is it buried in the seventh paragraph of FireEye's blogpost, after a lengthy discussion of the attackers targeting -- though apparently not primarily targeting -- FireEye's internal tooling?
As a red teamer I want to clear up why we build "hacking tools" and why FireEye did nothing wrong here.

For example take the tool mimikatz [1], which is publicly available and well known. It can dump stored passwords out of Windows memory. But if you download mimikatz and try to run it every single antivirus/endpoint protection solution will light up like a christmas tree. However, the underlying technique isn't being blocked - just the specific implementation. This is why we build our own tools: to demonstrate to defenders that while they are blocking a specific implementation they have not addressed the underlying vulnerability.

I do want to call out FireEye for doing an amazing job recovering from this situation. They did the responsible thing and released fingerprints [2] that could be used to detect every single one of their tools. They effectively burned their entire catalog and put them in to the class of "public" tools that are easily identified. I've browsed over the list of signatures and didn't see anything that popped out as giving a malicious attacker any advantage other than saving them work of building it themselves (of course I don't have access to look at the actual tools so YMMV).

Also, everyone gets hacked. No matter how good you are or how many cyber security engineers you have on staff... there is still Matthew in accounting that will open that invoice attachment so he can pay it.

1. https://github.com/gentilkiwi/mimikatz
2. https://github.com/fireeye/red_team_tool_countermeasures/tre...

Edit: To be clear I do work on an internal red team - we hack ourselves. I don't work for FireEye or a competitor.

Edit 2: Don't pick on Matthew. :)
From their page, does this even read professional? Sounds like some startup wrote it trying to make them look bigger than they're.

Community based sounds better to me.

> But if you're here, you're a CentOS user. Which means that you don't pay for a distribution at all, for at least some of your systems. So even if we made the best paid distribution in the world (and we think we do), we can't actually get it to you... or can we?
Is the Ford F-150 Partially Responsible for the Retirement Crisis
I'm playing Devil's Advocate here because I sympathize with your point, but isn't there a way you can squint and look at this weird that it's true of pretty much everything else? IBM makes tons of money off of Linux, for example. iXsystems profits off of FreeBSD. Facebook profits off of their wildly popular C++ libraries.

I think we really need to divorce "profit" from "open source". OSS is great because we can contribute our own ideas to it, because we can learn from it, because we can form communities around it. It's also useful because it's a vector for entrepreneurship. Edit: why should these be mutually exclusive properties?

It's fair to point out that it can be a vector for exploiting unpaid labor. But that's an accessibility issue that exists already. For example, it's easy to tell folks interested in the field to "do open source work" if they want to get a job in the field. If you're a low-income single parent, this doesn't make CS more accessible, it's a sick joke. Even without profit, open source isn't this bastion of opportunity that we sometimes like to think it is.

You make an excellent point that it's hard to learn large new systems. But it's not impossible. Indeed, it's possible to make super meaningful contributions to the system in "limited time", starting with net zero knowledge: https://blog.quarkslab.com/playing-around-with-the-fuchsia-o.... To that end, I have to disagree that we're the kind of project that outsiders can't meaningfully contribute to.

I've addressed the point of community consensus elsewhere. All I can say here is that I personally owe my career to open source, and I'm therefore committed to helping others do the same. We opened the project to communicate with people. My personal goal is to do this and help as many people as possible succeed professionally through this vector.
A little stretch ... yet I needed a decompiler for Mac a while ago and used https://www.hopperapp.com/ (also recommended on the German fanboys.fm podcast). found it was doing its job quite well (with a couple of helpful features, espcially the flow control graph).

It‘s commercial though.
A Mac / Linux Decompiler
You are correct. It's a silly hack. Just because it happens to work doesn't make it a good idea. Turn off JavaScript and you just get JSON text.
To be fair, you'll have a much better time down there if you maintain the fantasy that you were a charming model all along and that American women are cold prudes. Wealthy geeks finding fulfillment of their "so rich that models have to fuck me" dream in the third world is a bit of a trope.
HTML templating with XSLT may be used to save data, too.

For example, if you build a social network profile page using XSLT, alice.xml and bob.xml can reference the same profile.xsl stylesheet which converts the XML profile data to the rendered HTML page. Since the profile.xsl stylesheet can be cached, whenever a new profile is visited, only the profile data in XML needs to be transferred.

Note that the templating can also be used to save data when rendering a single page. Imagine a Twitter clone that displays a list of tweets. If, hypothetically, 80 characters of Tweet data plus 500 characters of XSL template, produce 250 characters of HTML markup, you only need 3 tweets to start saving data (250x3=750 > 500+3x80=740).
Generator size too, kero needs a larger generator, but Kero also has much better energy density per gallon than naphtha.

But you need two fuels to match start a Kero stove (or a butane torch) as Kero is not match lightable (neither is diesel)
Indeed. It would, however, provide very strong evidence for most such claims. The primary problem with actually implementing it in general is the risk of getting unlucky if you have a very large payout. Say you claim $100,000,000,000. Even if it is an accurate assessment, somebody could randomly luck into a vulnerability that would normally actually take $100,000,000,000 to find and suddenly you are dead since it is highly unlikely you are one of the few companies that can actually survive such a payout. You could alleviate that to some degree with insurance in the middle range, but it is highly unlikely that would work at the very high payouts. Luckily, in this case, a payout of $100,000,000 is actually within FireEye's reach given their revenue and market cap. In fact, they lost more in market cap on this breach news than such a payout. So, if their claims are actually true, this is an entirely feasible and useful demonstration to run.

Personally, I think if they actually announced a $100,000,000 prize they would be breached within a week on the outside. At $100,000,000 people can burn dozens to hundreds of zero-days to be the first to get the payout and still come out ahead. Even at $10,000,000 I doubt they would last more than 1 month. At $10,000,000 the prize would be the most attractive bounty in the entire industry by a factor of 3-10x and people could still burn some zero-days and still come out ahead.
This is incorrect. All of the 100 years of historical US market data show that the indices tracking “value” companies (of which one component is low P/E) have outperformed “growth” companies over the long term. There are several explanations for this, one that irrational investors periodically pay premiums for “lottery tickets”, like the “next FAANG or Tesla.” But while the explanations aren’t conclusive, the underperformance of growth is.
That's a big if. One has to learn how to not over-complicate. Exactly the reason why latex has usability issues in many cases.
I agree:

indirect -> previous next -> first element

"indirect" points to "previous next". "previous next" isn't a list entry. "previous next" points to "first element", which is a list entry.
I've recently given Linux another try, for use on a machine meant as a media server, and also to drive my family "video call station" (i.e., combine big TV, webcam and a bluetooth audio widget with mic and speakers so that the kids can talk to their grandparents in COVID times). Went with the most main stream distro, Ubuntu 20.04.

Result: couldn't get the Bluetooth conference widget working. Googled around for hours and tried all kinds of things, including compiling and installing kernel modules and replacing the bluetooth stack. Nothing worked. No, this is not an exotic non-standard protocol, it's a standard one (I think aptX or so? sorry, forgot the details again already; but I googled around and found lots of people with similar issues, and then many "solutions", none of which worked; see above)

Anyway, I am back to plugging in my MacBook each time we want to video conference, and will soon install Windows on the media server (no matter how much I hate the thought).

I really want to use Linux for this kind of stuff, but it's 2020 and I can't get a Bluetooth widget working that works flawlessly on various Macs, Windows machines, iPhone, iPad and an Android phone.

So while things may be better, they are still far from where they could be, I am afraid.
BGW320 is the new model, which I had installed about a month ago. It isn't a simple swap, as it uses a SFP module combined with the modem's internal ONT instead of a separate ONT, so I've heard it's only used in new installations. More about it: https://www.dslreports.com/forum/r32605799-BGW320-505-new-ga... (although theirs says 1550nm while mine says 1310nm)

However, it has 5Gbit Ethernet, hasn't re-enabled WiFi on automatic firmware updates, and has only screwed with my IP Passthrough configs once which was resolved with a router reboot. (that was possibly my router's fault, it seemed like it was unable to fetch a new DHCP lease)
Are you under the impression that unless something is both illegal, and produced enough evidence to be convicted in court, it cannot be disgraceful? There's no possibility of a world where the police do disgraceful things legally, let alone disgraceful illegal things and get away with it?
Part of the goal was to have a large image of the remote person’s face at a height that’s comfortable for interaction and conversation, which necessitates a screen mounted fairly high up.

To your point, I bet a picoprojector mounted down low could be made to project onto a lightweight screen in place of the tablet.

(The tablet arrangement worked well enough in practice, and we used a tablet that had already suffered child-related damage)
I still have my copy of Code Complete 2, and considered it a huge boost as well.

I've got to remember to revisit it soon.
If only hacked companies were as good at defense as they claim to be at attribution.
Start to make money online in 15 minutes or less
An existing support contract?

If you run a for-profit operation, and downtime is costly, you (or your VP of eng) want a way to pay for immediate assistance from the OS's maker / distributor, when (not if) things go wrong.
> There’s also something to be said for sensible abstractions. Even if the power users don’t have the control they want, the solution works for 90% of all other users.

There's something to be said for writing some things in some kind of Simple English [1], but it's quite different to take the position that most things should be written in it. Too often modern system designers seem to take something analogous to the latter position.

[1] https://en.wikipedia.org/wiki/Simple_English
This is an amazing idea, but this is very complicated to write ,I think, because you need to write html lines.
Georgia Institute of Technology. If you’re going to write about a school, at least get it’s name right.