skysight-inc/HackerNews huggingface dataset:
The book is amazing! The technical analysis by Symantec [1] also makes for a very good complementary read.

[1] [PDF] https://www.wired.com/images_blogs/threatlevel/2010/11/w32_s...
Can anyone "in the know" objectively comment if Google Safe Browsing (GSB) has had a net positive result or outcome for the Internet, at large?

Has GSB helped users, more than it has hurt them?

The anti-Google rhetoric [on HN] is becoming more tiresome as of late. Personally, I welcome the notifications in my browsers that a domain is unsafe. I can't possibly be the only one.
I've recently had much more luck with https://johnnydecimal.com/ , mirroring content structure across all my devices and even physically.
If u seriously believe we the youngest country in the world r not headed to exactly to where u just commented about
U r either blind to history of the world or a democrat!!
In ancient Athens, ostracism did the job of impeachment
If the added column is nullable or if you provide a constant default value, the table is not copied, neither online nor offline.
Yes, exactly this. Though it might be cleaner if instead of "no more than 63 bits" we say "no more than 2^63 spaces" on one side of the insert.

The author thinks it's very elegant that the rational numbers can be represented as a binary tree, and proposes some tricks to make the binary tree almost balanced and to make traversing it easy. You know what set is by default represented as a perfectly balanced binary tree where each bit in the representation tells you which way to go in the tree? The 64-bit integers.
This is actually a great idea and something I'm likely to bring back to my own teams!
Author here. The scary bit is that the blacklist is enforced client side in Chrome and other programs. Our servers and systems were running just fine when this happened, but if Google Chrome refuses to open your website, you're still down.

The closest parallel I can think of are expired SSL certificates, but the level of transparency and decentralization of that system vs. this opaque blacklist is not really on the same league.
The story he links to, about the "Online Slang Dictionary" being removed from google search because the founder of Urban Dictionary was friends with googlers (true) and (allegedly) used his influence is fascinating:

http://onlineslangdictionary.com/pages/google-panda-penalty/
Not trying to talk about existing politics.

Outside of a rogue president that convinces the military to act in illegal activity or a true government overthrow it won't happen.

No running or existing government in the USA will pull the plug because they know that would end their career. All their fundraising gone. Wall Street RIP. Riots all over the place.
Yes, the power of something like Google Safe Browsing is scary, especially if you consider the many many downstream consumers who might have an even worse update / response time. Responsiveness by Google is not great, as expected, we recently contacted Google to get access to the paid WebRisk API and haven't heard anything in a few months...

However, phishing detection and blocking is not a fun game to be in. You can't work with warning periods or anything like that, phishing websites are stood up and immediately active, so you have to act within minutes to block them for your users. Legitimate websites are often compromised to serve phishing / malicious content in subdirectories, including very high-level domains like governments. Reliable phishing detection is hard, automatically detecting when something has been cleaned up is even harder.

Having said all that, a company like Google with all of its user telemetry should have a better chance at semi-automatically preventing high-profile false positives by creating an internal review feed of things that were recently blocked but warrant a second look (like in this case). It should be possible while still allowing the automated blocking verdicts to be propagated immediately. Google Safe Browsing is an opaque product / team, and its importance to Google was perhaps represented by the fact that Safe Browsing was inactive on Android for more than a year and nobody at Google noticed: https://www.zdnet.com/article/mobile-chrome-safari-and-firef...

Lastly, as a business owner, it comes down to this: Always have a plan B and C. Register as many domains of your brandname as you can (for web, email, whatever other purpose), split things up to limit blast radius (e.g. employee emails not on your corporate domain maybe, API on subdomain, user-generated content on a completely separate domain) and don't use external services (CDN) so you can stay in control.
1) Google doesn't want any humans in the loop. Humans are expensive. Would sending a warning first result in more humans involved or less? More. So not gonna happen.

2) Google claims any information given to exploiters of its rules and systems aids the next attempt. So they don't like to give out any information about what AI rule you tripped to get banned.
If your devices are kept connected this means that your wifi and router are still active, probably the issue somewhere behind your router, either a connection or provider. But due to exact timing it's likely something on the provider's side and not just some connection issue.
I would personally start with contacting them to investigate.

You might also check the router's logs for that time, perhaps there's something useful information.
You still have to decide if you want to use the default value or something else at every place.
I 100% agree. All the hoops you have to jump through and things you need to enter regarding personal information always makes them feel like a honeypot. Not one moment in initial onboarding process do I feel like I'm legitimitely giving my info to HR but some scammer in god knows where.
TSMC Preps for 3nm Risk Production
Nintendo Hates You: Gaming Giant Lobs a DMCA Nuke at Hundreds of Fan Games
If this is all true, This was a very personal attack. This doesn't seem to be for financial gains but personal vendetta.

Putting that aside, she should be equally blamed for falling for it despite being a fact checker for 21 years and also attending seminars, advisory meetings, talks and interviews as "Harvard Professor" without even going to a lecture hall once.
> I received an automated email confirming that the review had been successful around 2 hours after that fact. No clarification was given about what caused the problem in the first place. ... We never properly established the cause of the issue, but we chalked it up to some AI tripping on acid at Google's HQ.

I expect more of this Kafkaesque experience to come in the future.

This is no longer a technical problem, but a social one. It can only be solved through legislation.
She mentioned she was interviewed online. Was it a video interview or someone IMing questions? A non video interview would have been a red flag to me.
The point is that you can create a full FOSS runtime (+ drivers) for VR that will be compatible with most software out of the box. I think there was a project called OSVR that tried to do this, but I'm not sure how that's going.

You could probably bring a lot of this work into the kernel if VR becomes popular enough.

I've found that Valve is pretty good when it comes to respecting their users. SteamVR software isn't even DRM'd and can run without Steam.
Great, so legitimate businesses need to implement tactics commonly used by c2c and malware to operate successfully
It's absurd. This thing happens on the play store. I've seen it happen multiple times due to pure mistakes. It takes an appeal and time to resolve the issue, in the meantime you are stuck.

Their appeals form only lets you submit 1,000 characters, no images or attachments. So in many cases, it's hard to even provide proof of the mistake. For example, if they falsely takedown your app for trademark infringement, but you have priority rights in a country or a registered mark, how are you supposed to effectively prove that in 1,000 characters with no images? In one case, we had a decision from the trademark office in our favor, but we were unable to attach it in any way and had to try and summarize it in like 300 characters.

There is no reason in most cases to not provide a warning period and the opportunity to provide evidence and exhibits.

They act so much like a monopoly in this case that they are stupidly making things harder for themselves. Sundar and Google's legal team should take all the PMs aside and tell them they are going to start losing antitrust cases left and right if they can't provide more due process for decisions.
This was Harvard Extension School. You're not talking a tenured Harvard professor position. One of my mentors undergrad was a former Newsweek editor who lectured a couple days a week and also didn't have a PhD or academic publications. (He had written books.)
I'm guessing the scammers did something like person@hr.harvard.edu.obscuredomain.tld

They've gotten pretty good at crafting domains this way.
While I think it's important to fight against the "FE is easy; BE is real programming" stigma, I think you're going bit too much in the other direction. You're painting FE almost as the most difficult thing that exists. However, it's not like GUI applications is a new thing. GUI applications which talks to the Internet is not exactly groundbreaking either.

> Updating a user’s role on the BE is a single SQL operation

Exactly! Updating a user's role on the BE is actually a really difficult task: You need to persist the data in a safe way and ensure that it's consistent with other concurrent actions that happens. These hard problems have been worked on for 50 years and what we've ended up with is a set of solid tools (SQL databases that provides transactions). It's thanks to these tools that BE becomes easy. These tools have also been built on top of each other. A new tool often "extends" an older tool instead of "replacing" it.

It comparison, look at some of the "progress" in the tooling in the front-end world: One of the biggest recent change in state management is React Hooks. This is a concept which has zero precedence in any language or literature. It's something they invented out of thin air and behaves like nothing else out there. The documentation has a big list of gotchas you need to watch out for. Does it has its advantages? Sure, it's nice for many things. But of course there's going to be rough edges when introducing such novel concepts.

Cocoa has been successfully using view controllers for state management for 20 years (or more?). They've made some tweaks over the years (e.g. segues), but it's mainly stayed the same. Is state management perfect in Cocoa? No. Do you hear Cocoa developers complain about state management? Yes. Do they spend every year talking about the "new best way to handle state"? Nope.

I understand that it's not completely comparable (different platforms etc), but of course state management becomes a recurring problem when you end up switching out the state management library every second year (Redux anyone?).
I would argue that kubernetes is often overblown for small firms.

But service mesh is getting easier and easier by the day. And brings quite a lot of benefits!
Lishogi
As a person why suffers from myopia, I find this analogy offensive.
I'm, kinda thankfully, about 20 miles north of there so I'm close to a whole bunch of parks. It's still not ideal being the northern suburbs and all, but within 30 minutes drive I've got half a dozen nice green areas, and a few within 10.
I figure if it's actually important, they'd personally meet me or call. You don't respond over email hoping an instant response. It's obvious from the start of the email.
Any time you connect to a website, you reveal your IPv6 address. I can bet there is a market for making lists of valid IPv6 addresses from web logs and selling those lists to people who want to port scan those hosts.

You might even find big carriers mine IP packets to find IP addresses they can sell.
"never attribute to malice that which is adequately explained by stupidity" and all that, but after the events and the almost perfectly orchestrated behavior we've seen in the past and last couple of weeks it's becoming increasingly difficult, at least to me, to not attribute this to malice. Probably deliberate negligence is a better term. They know their systems can make mistakes, of course they do, and yet they build many of their ban-hammers and enforce them as if hat wasn't the case.

This approach to system's engineering is the technological equivalent of the personality trait I most abhor: the tendency to jump quickly to conclusions and not be skeptical of one's own world-view.

[1] https://en.m.wikipedia.org/wiki/Hanlon%27s_razor#cite_note-m...
Nah, it just means that:

(a) True cancer cures will be more dynamic than cutting bits off, like very sophisticated immune therapies, or

(b) We'll get really good at replacing cut off bits.
Try and get hold of your Internet/WiFi router's logs. The answer will probably be in there.
Wait, "stay on the line long enough" was an actual thing? I guess that means shorter calls were free, as they could not be documented/invoiced?
>WhatsApp's "secret" weapon for getting such great scalability for so cheap was choosing to use Erlang.

WhatsApp's "secret" weapon for getting such great scalability is the decade the founders spent at Yahoo building scalable systems, if I'm not mistaken. Give Erlang to someone else and they'll build a system that'll choke. The language is not the only part of the system.

There was a sudden increase in the number of users, amplified by many Twitter account holders with huge audiences tweeting about moving to Signal. The system was designed with tradeoffs and assumptions. These assumptions changed and the system is unstable. They're likely trying to reach a steady state with a new set of assumptions and tradeoffs.
> I'm no Web developer, but I imagine the equivalent for a Web app would be to display a terse error in the browser and save a verbose error in the logs.

Services like Bugsnag are designed for this use case. You can send them an error message with arbitrary JSON attached (cause of error, but also details on the logged in user, device, browser, etc). And then yes, generally a generic "Try again or contact support" error message presented to the user. It works quite well if/when they do contact support because you can lookup specifically what errors have been triggered by that user.

Of course anything is better than nothing. When I took over this codebase its error handling strategy was "Don't show an error message at all and just keep retrying until it works". Which was fine for transient errors, but a nightmare when something did go wrong: the user report would usually be "the loading spinner just keeps spinning forever", and that was all you had to go on. Nightmare.
So the author writes their notes in mark down with a VS code extension and stores them on GitHub?

Is there more to this that I'm not getting?
Unless harvard’s email severs were breached, this seems like a case of user error... Harvard.edu has SPF headers which should be enough to detect fake emails right away. If i’m not mistaken you’d have a really tough time spoofing those emails.
Yes I agree with you (and thank you for your medium post by the way. Our only chance of ever improving the situation is to call attention to it. I fully believe Google leadership has to be aware of it at this point, but it clearly won't be a priority to them to fix until the public backlash/pressure is great enough that they have to).

Just to avoid any misreading, I didn't say I thought it was malice on Google's part. My opinion (as mentioned above, is):

> I still don't think it's outright malice, but the doubling down on these horrific practices (algorithmically and opaquely destroying people) is so egregious that it doesn't really matter.

So they are not (at least in my opinion without seeing evidence to the contrary) outright malicious. But from the perspective of a site owner, I think they should be considered as such and therefore mitigations and defense should be a part of your planning (disaster recovery, etc).
In the Netherlands we have a kind of rattle. Slow when red fast when green and intermittent when about to go from green to red. Although I must say they are not everywhere.
Yeah. The alumni emails probably follow a pattern. Get a list of alumni and find one who hadn't set up an email forwarding address previously and set up an account.
I wonder if a blockchain/bittorrent decentralized option could exist to replace google.

most people don't have billions lying around to compete, but you could reward people who rented out space for the indexing data, and have advertisements baked in that could maybe still use some retargeting but without tracking any personally identifiable data about a person.

Nodes could double as ai/cpu processing for algorithms related to search and storage. Computation and storage amounts could have their own payout per action, or per time on storage.

Most people have their computers on all the time anyways, so if they're working in the background for them to earn some side income, while helping create a better internet.

Would need some centralization I'd imagine though, I think the problem with de-centralization is the goal is ALL or nothing.

Like one or two big servers that maybe tie everything to the rest, and push 'updates' on algorithms, contracts,etc... to end users. Maybe a segregation index, knowing all airplane related searches are indexed on cluster c which has nodes 1-8, so you know where to go to get the info being searched.

I'm a mainly full-stack but 'dumb' developer, not an algorithms wiz, mostly focused on crud apps. But this would be fun to build.
I think GSB is great because there is no other product like it, it is very fast to respond to most threats and it can be used for free. The only thing about it that's not great is, in typical fashion, the lack of transparency about some of the processes. Not about how phishing verdicts are created, this should remain a closely guarded secret, but about what actually happens when you send a report or send a review request.
This is the flipped classroom model. Definitely not widespread, but it’s gaining popularity, even in universities. The system is slow to change.
summarised as: yeah no.

What about complex numbers? is there something similar there? Not even so much necessarily on the negative numbers. Anything interesting amongst the Js?
If only the title was intended as a pun :)
Just an American thing? People online seem to say this all the time but I can’t imagine any country that talk more about sex and ex positivity than America.
Do you have xfinity by any chance? And are you using their x1 combination modem/router in bridge mode with custom (non-comcast) DNS settings?

Because the exact same thing was happening to me at the exact same time. I’m no networking expert but when I checked the logs it seemed that every day Comcast would try to “fix” my (not broken) DNS settings. I had been using mullvad DNS and open DNS as backup but since switching to nextDNS the issue has stopped.

I don’t know enough about networking or DNS to offer any explanation as to why.
I hadn’t heard of Zettelkasten until today. I want to give it a go, but I’ll be honest, I feel a bit overwhelmed after reading about it. I’ve never catalogued my notes before or given each one a unique id.
If you think that's bad, imagine being a DBA and reading almost anything online about databases.

I have to give SO credit for improving though - they went from 0/10 5 years ago to "often useful" today.
Yeah i read stories that Yahoo in 1990s called itself a media company and it's product managers "producers" out of fear that once you call yourself a software company - Microsoft will crush you...

As for using clouds - there is absolutely no point in the world to use them for anything above staging level, or very very low level launches. People should switch away from cloud as soon as they see even tentative signs of a product-market fit.
Author here. It's not really rhetoric, I wrote the post because it's downright scary that your business of over 10 years can vanish in a puff of smoke because Google didn't bother to require an offending URL field in an internet-wide blacklist. At the level they operate, there needs to be a semblance of due process.
Thanks, I totally agree. Just to be clear I'm not saying it's malice as I don't believe that. I'm just saying the end result is the same so one should consider them a hostile actor for purposes of threat modeling.

Given you're the second person who I think took away that I was accusing them of malice, I probably need to reword my post a bit to reduce confusion.

Accusing them of malice is irresponsible without evidence, and if I were doing that it would undermine my credibility (which is why I'm pointing this out).
As a planet you mean.
I'm not as right-leaning as "City Journal" is, but I have one big question:

Since we now have two vaccines, isn't any money we can scrape up or print best served getting the vaccine to people? Any dollar that's not spent vaccinating someone is a delay to the end of this mess.

Raising the minimum wage to $15 nationwide to help us get out of a pandemic rut when small business are suffering seems _very_ misguided.
Bugtraq has reached its end – here’s why it matters
Well if you'd just quit making goals it finishes up real quick!
Great article. It’s not malice, it’s indifference.

Googles execs and veeps don’t care about small businesses, because most are career ladder climbers who went straight from elite colleges to big companies. Conformists who won’t ever know what it’s like to be a startup. As a group, empathy isn’t a thing for them.
Maybe there’s a confusion of terms here, because I think everything you’re saying is what it means for a bathroom break to be unmetered. You can go to the restroom whenever you’d like, as long as you’re getting the work done. If you had specific declared bathroom breaks where the company keeps count and pauses performance metrics for the duration, that’s what I’d call metered breaks.
Signal messaging platform stops working as downloads surge
Facebook Inc. vs. Davis
No, it took time to actually trace the call through the exchange(s) and through the Transatlantic communications satellites. I'd recommend you read the book if you are at all interested, it's great.
MY INTERNET HAS BEEN GOING OUT AT 3:40pm PT TOO!

Sorry for the all caps. I just scrolled through my texts and saw the “internet out?” texts are at the same time.

Hopefully that means it’s a provider issue behind us. Wonder what we have in common?

- South Lake Tahoe, CA

- Spectrum Gig internet

- Asus Zenwifi mesh
Get better hardware and software that properly reports error messages instead of hiding them.
Disconnect your wifi gateway and plug a computer directly in to your modem. Eliminate or prove the router as the problem source.
> For one thing, repeating the entire search query in bold isn't necessary.

I hugely agree with the thrust of this article, but this Google example might be a mistake to include. It’s the only lay-person example here, not a shell or programming language for technical people. Showing a Google query back to a user, I might speculate, has an important function of allowing users to see spelling errors they didn’t know they typed. I can imagine other reasons as well, and I’d be willing to bet that Google has tried both and decided on repeating the output. The other thing not discussed is the Google output is organized hierarchically, separating the error from the tips, and bolding the search query. Those two things could dramatically improve the PowerShell output, for example, without removing any text. No other example had style formatting, and good styling and layout can be as effective as silence.