skysight-inc/HackerNews huggingface dataset:
With respect I think you're speaking outside the bounds of your knowledge of these systems.

> By "hardening the API server" I mean fixing actual security vulnerabilities…

That is just table stakes. Have you ever found any vulns in bank API gateways? We tested authorization boundaries with our own accounts, we didn't ever find a bug like that. I found a total of two bugs quite low impact. One was unsafe object deserialization that could potentially lead to RCE, we obviously didn't try this. The payload was signed so it most likely would have been difficult to exploit provided the signature was verified before deserializing the object. The other one was an authentication bypass, which potentially could have given you read only access to the user's accounts. You could then call up customer services and use recent transactions on the account as a knowledge based 2nd factor to be given a code to upgrade the read-only enrollment to write access. This would require some knowledge about the customer (account number, telephone number, etc) and sloppy CS, so would probably say that was also low risk. We reported both to the respective bank via internal contacts.

> When you talk about "breaking" banks in the US space…

Everything this thread refers to countermeasures banks employ to keep third parties from leveraging their private mobile API gateways. When I talk about breaking things I'm talking about breaking these countermeasures.

> I'm aware of your thoughts on this, though I respectfully disagree with the "modern" characterisation…

The content encoding of the underlying persistence layer is a tiny part. Their technology is broadly speaking very good. I am probably the world expert on the state of these systems because I have very deep knowledge of a large number of them, whereas even bank employees would only about their employer's systems.

> Monzo have at least never wasted time on obfuscating the fuck out of their API comms…

Monzo did other stuff to effect the same result, i.e. they only allow one device to be logged in at a time. So you couldn't use Monzo's app AND access your account via Teller at the same time.

I wouldn't use Monzo as an exemplar of technological capability. Barclays absolutely smokes them.
Purity and Security: Towards a Cultural History of Plexiglass (2020)
No, but it's automatically the right tradeoff for everyone.

Security measures are always a tradeoff between convenience and security. Not everyone's tradeoffs work out evenly. Sometimes backups are a more important risk to mitigate than government surveillance.
> “Remember the password” barely ever works, even on desktop.

It happens to me only when I keep switching machines (sometimes I play on Linux, sometimes on Windows) => I guess that it's some kind of security check.

If I stick all the time to a single machine then I basically never have to re-login (if I don't stop playing for something like 1 month or longer).
I’ve become a big fan of MikroTik routers and 10G/SFP+ router/switch hardware in the last few years. Their web UI and SSH console are a bit quirky but the performance is pretty great for the price.

My primary use case for their gear at home was to have a router that can handle a LACP WAN bond for my fancy cable modem as well as connecting to a 10G Ethernet switch via copper or direct-attached SFP+ to a CRS-305 10G switch. Their RB-4011 was a perfect fit, without any of the Ubiquiti SSO/controller stuff to worry about.

I haven’t explored their WiFi products yet (still using an old router as an AP) but their product range is pretty broad. Might look into it this year though.
It's also possible that HFTs make less money than other traders would have made, if HFT is actually making markets more liquid.
> Management: So we ship as planned, and fix the bugs in a patch.

What's curious, and I assume therefore legally-reasoned, is the consistent lack of preparation for blow-back by companies. Some part of CD Projekt Red knew the game was broken on older consoles.

It feels like the only real solution to this is to have legal QA documents, signed off on by QA (as factual) and executive leadership (as read and understood).

If there's a magically missing set of older console tests, someone in leadership goes to jail. If leadership publicly misrepresents the stability of the game despite knowing about substantial defects from QA reports, someone goes to jail.

Who cares about video games, but this is indicative of a broader social problem allowing executives to feign ignorance and create systems that deflect blame downward. Either you're running the company or not. And if you are... then the legal ramifications should ultimately land at your feet.
“I’m surprised Parler can find lawyers willing to bring it to court on their behalf, or banks willing to process transactions to pay said lawyers.”

Personally, I am surprised at the opposite. That a company cannot find lawyers to defend their position or process payments from their customers without due process is horrible.

The fact that you were not surprised by it is quite worrisome. I don’t mean that as a personal attack on you, but more as an observation of what has become acceptable or at least ordinary in a society.
People get acclimatized to their environment.

I'd eat popsicles in Hong Kong falls and winters because I've long since adjusted to the cold.
More like it's the politics that really decides what changes, regardless of what science proves
Sure, a "boutique bike service station" certainly wouldn't attract your typical Wal-Mart bike owner. But those bikes won't be served by the bike shop that runs the workshop at a loss for his loyal bike buyers either.

That part of the market is usually served, quite well actually for both sides, by a shop that is one third preowned bikes, one third budget parts and one third highschool job repairs (sometimes they also rent out the preowned). Lifesavers for my theft-immune three speed (they'll happily take on daring salvage operations nobidy else would even attempt), but I surely no place were I'd leave one of my Campag steeds even for just a tire inflation.
This ought to be on their blog, rather than mailchimp, no?
Building Faster AMD64 Memset Routines
The real problem is that the data generated by the user is very valuable to the social network owner, there's no way to make money allowing a user to have a private self hosted federated infra unless you charge the user and then no one wants it since Facebook is free. If you really wanted to, you could easily build a federated easy to use distributed social network, but no one does because you don't make money on it and passion projects only go so far.
So what is your alternative? Do we need to bend over backwards to appease the guys in “six million wasn’t enough” shirts? How much political legitimacy should we give to people who are all-in on ridiculous conspiracy theories? How much attention to Holocaust deniers deserve? Do flat-earthers deserve equal time in geography class?
I hope they’re getting lucrative stock options to make their 996 worth it.
I was confused by the parent comment too. Aside from the remote management features, if you turn off cloud login you still get everything else. Maybe it's something specific to the USG Pro? I've only used the smaller USG.
Donald J. Trump's term ended on 2021-01-11 19:22:18
That is not a good approach. Every piece of technology has it's place; requiring 2e2 encryption in a group of hundreds is a bad requirement.
Drops of Water
Surely it is possible to configure a custom search engine in Brave. I would be amazed if the list was hard coded.
GE, an old-school company, birthed a generation of tech leaders
The title would have been better if it started with “We’re Fucked:”
I played the game on PC too, and for the first half or so of the game I agree, the first half of the game was more "very very unpolished and rough" as opposed to "broken bugs".

However it got worse and worse the closer I got to the finale, on total I encountered around 10-12 situations that prevented me from continuing and required game restarts and/or loading of older saves, and I had to repeat my final mission 3 times because of a game breaking bug. That is on top of all the minor bugs others have already mentioned.

While I was able to at least get between 50 and 80 fps, the performance was absolutely terrible if I consider my specs (>3500$ PC build).

All in all I was "relatively bug free" compared to the experiences of others. What I don't understand are people saying it would be "a masterpiece" without the bugs, I disagree, the game was very bland in my opinion and I regret my purchase and the time I invested regardless of the bugs and problems. It wasn't TERRIBLE, but I wish I had spent the money on another game.
Right wing, nationalist leader decides to create law that would prevent his posts getting removed by the platform owner for violating their ToS, unless actually illegal under national law..

Can't help but wonder what recent deletions he could possibly be thinking of..
I don't see how this was posted for any reason other than to get the word out to like-minded people who will protest and/or pester Cloudflare to drop these customers. Seems like a misuse of HN to me.
are you not just highlighting the fact that there is a First Amendment right but not a broader "free speech" right, which is the very point people are trying to make.
Eat, pray, live: the Lagos megachurches building their own cities (2017)
What's so bad about influencer marketing? It is the norm these days. Inevitably competition will do it if you don't.
You are making a false equivalency.

Parler exists solely to provide a place for right wing ideology to escape from facebook and twitter’s moderation and fact checking policies.

It has already been used as one of the primary means of coordinating an attempted coup, and it was being used to coordinate subsequent attempts on the 19th and 20th. This is the activity which was not effectively being moderated, and arguably it was the kind of activity that it was created to foment.
They offered it in their store so it obviously met their certification requirements at one point in the past. Perhaps they don't really have certification requirements...
It's miraculous to see someone fight this hard for our human rights.

No man or woman has the right to take away your freedom of expression.
Trust isn't about blind, 100% trust. You can trust democracy to work without fitting yourself with a shock collar controlled by the pooular vote. You can trust government officials without assigning them blanket power of attorney.

I am just saying that there are limits to trust. And when someone you 99.9% trust tries to convince you to give them 100% trust, you should pause.
What systems were breached? I haven't received an email...

Is UNMS ok?
Awesome links, thanks. Indeed this is precisely the sort of design aesthetic I am looking for. You also helped me realise that I can broaden my search to include the keyword "infographic" - which should prove more fruitful than my previous failed attempts. Cheers!
>> https://github.com/systemd/systemd/issues/18184#issuecomment...

>>
If you can, please try it without using the C intrinsic. I have seen multiple compiler bug reports--https://patchwork.ozlabs.org/project/gcc/patch/2012052017042... is the easiest to find--that indicate that the intrinsics don't always return the right value.

Hypothetically, the sequence discussed there could be a compiler-bug, unrolling the loop and failing to treat the results of RDRAND as volatile.

So... yeah. Lets not overcomplicate things, but lets not undercomplicate things either. Without an actual disassembly of the code posted, there's no proof yet.
It's absolutely staggering to me that people believe everyone will self-host the decentralized social network, without thinking through the economics of the incentive layer, let alone how to achieve consensus/verification on compute and storage layers.

The first successful decentralized social network will be using the decentralized compute and storage systems being developed in the crypto space.
The problem here is with the time delay between manufacturing and the waste, especially as many manufacturers are abroad and short-lived.

It's feasible to enforce repairability conditions and documentation requirements before a device is sold, at the point of manufacture or import - if you're not compliant, you get excluded from the market.

It's not feasible to reliably and effectively enforce consequences for manufacturers years down the road, when it's plausible that the original overseas manufacturer and the importer/wholesale distributor both have shuttered their operations.

We can't wait and see how much waste will be generated from this device, we if we want to charge device makers a percentage based on how long before it enters the waste stream, this needs to be based on an up-front guesstimate - which IMHO is a subjective metric can't be reliable and just invites corruption and abuse.
If a politician can't block people because it is considered official communication, how can Twitter block politician's official communication?
Poland also has elected officials instituting 'gay free zones', and arguing that whilst Poland is progressive enough to have legalised homosexuality in 1932, people waving rainbow flags and talking about homosexuality are as dangerous as Nazis and Communists. Poland is not free from bias.
As buggy as the game was on launch, and as badly as this damages CDPR's reputation, I have not heard a single thing that implies they broke any U.S. laws. How this Polish office works, I have no idea, but I guess I'd be surprised if they came to a different conclusion.
Neither does XMPP, given it doesn't store it ;)
I see the stances as very different. Parler is a social media site dedicated to extremism. While I believe in their 1st amendment right to exist (not all speech is protected though) I do not like this group. On the other hand I see companies like Signal and CloudFlare as being neutral. They have taken a position that they choose not to be the arbiters of right and wrong. These companies also aren't dedicated to extremism. I believe that being able to speak freely and make mistakes is an essential part of democracy. A privacy preserving platform protects this idea. If the service is dedicated to the public (aka neutral) then I think this is the right move. Extremists will (and have) congregate on Signal (as they do on WA, Telegram, Twitter, 4Chan, Facebook, etc). I see encryption orthogonal to the issue of extremism. This may make it a bit harder for security to monitor these groups (no dragnets), but if they are mass groups it won't be hard to infiltrate anyways. If a member of the public can get in then why can't someone from the CIA/NSA? It might as well be in clear text. If they can't infiltrate these groups then we have much bigger problems and everyone has been overestimating the power of these organizations for decades.

So to sum up. I highly value privacy and security (especially as we're adding more to the internet. The danger is increasing). But I'm against extremism. It is a numbers game that more public members will gain value from privacy than the dozens of terrorists who will. But it is a different situation if someone creates a space dedicated to extremism.

(I do think this is a very reasonable question to ask though)

Edit: I wouldn't say that Signal will be completely unmoderated. Groups still have admins. But you're right that Signal won't be able to moderate. But this isn't that different from any federated platform.
> Systemd is literally the only software, that has this problem. I am not aware of any other software, that uses rdrand and expects high-quality cryptography-grade randomness.

Please seek out and understand the reasons behind calling RDRAND in systemd before making statements like these. "High-quality crytography-grade randomness" is explicitly not required for the purposes of the PRNG at boot-time, which include UUID generation and seeding hash tables.

https://github.com/systemd/systemd/blob/61bd7d1ed595a98e5fbf...
But you can? Open a conversation -> Menu -> Conversation settings -> View safety number.

Note that the safety number is basically a combination of your and your contact's (DHKE-negotiated) keys and is thus going to be different for every conversation. The reason both keys are not shown separately is that it apparently confused users.
My understanding is that WhatsApp backups are plaintext. It's true that Apple/Google can't recover your WhatsApp account with just the plaintext, but I believe they can read the messages.
Freedom of speech is also freedom from compelled speech. This kind of law means the government can compel any private party to speak what they want and punish them for not doing so.

This is also demonstrably damaging to the effected party. It costs money to host content. Forcing a business to host content costs them - is poland going to fund this? No.

If the polish government has a problem with it then they should make their own government backed social media platform. Not violate people's rights.
That is simply a different question
Parler wasn’t deleted because of public pressure alone. It was deleted because of AWS customers that threatened to leave. Last thing large enterprise customers want is to be caught up in is a controversy. Amazon made a business decision. No tech executive wants to explain to their CEO that they got boycotted due to a tech vendor choice. If AWs didn’t kick off Parler, the boycott of AWS based customers was coming.

No company should be forced to lose money.
You're only really a liberal democracy if the ruling elite can coerce private actors to take the repressive actions instead of doing it officially. You must also allow your civil service to be an unaccountable branch of government controlled by the professional managerial class and unresponsive to the commands of elected leadership (unless they're from the correct side). Furthermore, you must allow lawyers to use the judiciary to rewrite laws to suit their political preferences (e.g. your Constitution must be found to guarantee the right to gay marriage, an idea laughable to people who wrote it and to everyone until 15 years ago). Finally, you must protect all classes of people from unjust termination and unwarranted denial of service except for everyone whose political views align with the wrong half of the country. Thank God we live in a real liberal democracy.
I haven't read the article I'm just joining in on the side-discussion in this thread.
I'm surprised you keep bringing this up, because you know the counterargument here. "Whiteness" is in fact a problematic term. Italians, Jewish people, and the Irish have all been excluded from "whiteness" at times. The term expands as needed to provide solidarity against Black people. "Black", on the other hand, is an actual ethnicity --- the one we created when we kidnapped millions of people in Africa and stripped them of their original culture.

Anti-whiteness crusaders can and frequently do go too far, but I object, strenuously, to the idea that mainstream articles about problematic whiteness are somehow comparable to anti-Black racism. That isn't true, and I think you know that.
HN has turned into a complete authoritarian echo chamber because all dissenting opinions have been banned. After years of using this website, I'm disgusted by what it has turned into. Go ahead and ban me, I don't care anymore. I'm not coming back here again.
Out of curiosity, which facts do you mean?

The law is stupid of course and an attempt to fight for their point of view(that is: xenophobic, racist and intolerant), but history is a subject rather widely discussed in Poland with all the sides being represented in media.
> Now Parlor gets "canceled" by vendors for not doing a good enough job trying to moderate content promoting violence.

Parler got canceled for something a lot worse than the Daily Stormer.
> When you see a DoJ press release talking about someone potentially facing a very long sentence, they don't mean that the particular person being indicted is facing such a sentence.

Short ver:
DoJ: either make our prosecutorial life easy or we're going to harm you way beyond what is ethical.

Long ver:
DoJ: You did A. Lobbyists have composed and purchased laws against A. Those lobbyists are pressuring their legislators to have us deploy high-profile Gov revenge on their behalf.

We want to charge you with B and have you accept that w/o resistance. To that end we are charging you with B,C,D,E,J,K,L,Q,R,S,T,V,Y and some Dr. Seuss letters we came across.
Let Poland run news.polishcombinator.com where they decide to not moderate anything not against Polish law then

Are we going to have dang explain how any post he moderates violates Polish law? What about what he's moderating which isn't illegal in Poland?
Ask HN: How did you meet your significant other outside college?
No provider is going to sign a contract that forces them to host illegal content that opens them up to liability.
I mean you can try to share child pornography through your ISP's network and we can see what happens? Shady stuff are mostly shared through decentralized networks and its the centralized www that's preventing them.
To me this decentralization fetish feels like people think government are stupid and inefficient so we should have no government at all
If you define "containment" as "provable non-harm" then sure. But there are essentially no complex physical systems that we can put such computational bounds on. Since "harm" comes in some form of physical actuation, I would argue that we can only ever get to something like the sort of confidence we can have that a particular manufactured part would succeed under load. The map is not the territory, and any computation that does not include computing the whole universe is necessarily but a map.
Kinda interesting as a threat model, if 4chan/the wrong people can maliciously use your service enough to get it cancelled / shutdown just for the lols. I imagine a few startups aren’t building moderating content / moderation teams as part of their MVP..
Nonprofit news organizations are a thing and I've been incredibly positive about their future (full disclosure: I used to work for a nonprofit publication).

The nonprofit model encourages much more direct community engagement through conferences, festivals, and long-form interviews with local, state and national leaders.

A major hurdle that nonprofit and higher-quality news outlets face is that the major media players have dopamine-driven news down to a science, and it's a lot easier to consume a small and practically meaningless soundbyte than it is to sit and listen to a politician have a challenging discussion with an interviewer for an hour. The attention span of the average American isn't equipped for higher-level discourse as it's not nearly as exciting and rage-inducing as watching CNN/FOX/ABC/??? network.
It seems to me that whoever wrote this article has no idea what an MITM attack means.
A while ago, I got a lot of flack here for suggesting that github wasn’t a social media website.
If Bitcoin Applies CY 2020 Growth Rate to 2021, Surpasses $ Circulation in 2021
I'm mostly joking sir. But I make a mean apple pie (butter) if you're interested in trade!
I would also _highly_ recommend The Dispossessed from her same universe. I personally preferred it, but both are really great "sci-fi tackles seriously complicated real life topics" reads.
My theory is online streaming is more of a factor than the show
wasn't there an active insurrection in 2016 as well? The Obama admin was trying to entrap members of the Trump team and people rioted during the inaguration.
Or if you live in a four story house with half a meter of concrete between every floor...

I’m really happy with my UniFi kit..
Those are the “approximately”s. :)
I don't think you'd have easy time arguing in the court if you did something like that
*We’re self fucked :-)
You don't become a billionaire by being naive. Why would anybody choose to become a billionaire under such conditions? Was there a chance he'd come out on top?
Vaccine roll out: Israel's circumstances aren't special