skysight-inc/HackerNews huggingface dataset:
Ask HN: How to handle security researchers with fuzzers and other toolkits
I am involved with an open source CMS project. Part of my role is triaging incoming emails to our project inbox. A gradually increasing percentage of these emails come from security researchers, advising us of issues they've found. We've had an uptick in overall volume this year after a crypto-funded bug bounty site appeared, found us, and a slew of reports landed. The majority of these reports weren't issues – rather, they can be summarised as "an administrator can do administrator-level stuff" within the CMS. We don't consider these vulnerabilities, and we say as much in our security statement.

More recently, we have had an increase in researchers with fuzzers, toolkits and other rapid-fire stuff. Around 90% of these researchers are focussed on getting a CVE. With the reports we receive, it's rare for a researcher to include a proof of concept, even after we politely request. It's typical for this type of researcher to say there's a problem with file X in directory Y, and btw please can I have a CVE now for my research project / wall / work promotion / and so on.

I'm not sure how this sits with me. Researchers who provide info, PoC code, and sometimes even a resolution are very straightforward to deal with – and hugely appreciated. My gut feeling with the fuzzer-type researcher is that they're taking the spray-and-pray approach as CVE or beg bounty hunters, and that's less clear cut from a comms point of view. I don't want to be getting into semantics with those researchers who have vague reports (minus the PoC) but are still adamant they want a CVE trophy, where essentially they've run a third-party tool that says "there might be a problem here, not 100% sure".

I'd love to hear your advice on this. What could be done to make this situation more tenable?

Off the top of my head:

* bump up the security content on our website so it's more obvious what we're looking for (and by extension, what we're not looking for)

* learn how fuzzers work and do the fuzzing ourselves

What else might work?
Not sure why you got the impression that I haven't used software in the 2000s.

My understanding right now is that if you have a software that people need to install and your competitors have an in browser offering, your customers overwhelmingly choose the in browser offering.

This has been my experience even though I hate the subscription model as much as everybody else in this thread
This seems kind of silly. Should radio equipment manufacturers be liable for the Rwandan genocide? I'm not fan of Facebook (I don't even have an account) but requiring them to fulfill a function that the Burmese government didn't do seems shortsighted.
Yes, but even there the consultant made a point about making the transition as smooth for the fired person as possible. The whole point was not to stir up negative emotions, which by their very nature are unpredictable.
> I can see why you chose to create a throw away account in this case to comment. I now see i'm being trolled by an anonymous account :( I'm sorry I feel for it.

Please don't include stuff like this in your comments. It degrades HN, and does not "assume good faith", as the HN guidelines ask you to do (https://news.ycombinator.com/newsguidelines.html). The commenter could be uninformed, or have genuinely thought that their quote backed up their position (and just been wrong).

Saying that you're "being trolled by an anonymous account" is bad form and definitely not the kind of stuff that I want to see on HN.
Starting to wonder if the name became "Meta" so that the headlines wouldn't read "Class action suit filed against Facebook" or "Scandal involving Facebook".
I was on YouTube and got a whole series of ads about a hat that would protect me from 5G …
> As someone who used 5-whys when I worked at Amazon, I love it and the criticisms here don't resonate. It's not about finding one path of causation, or finding everything you can point a finger out. It's about being willing to admit the actual causes and then do something about them.

You're right, of course. To do causal analysis at all, you have to do it respectfully and well. That's the first step.

When you have the first step down, there are other analysis methods that are not five whys that does this better. One of my favourites is Leveson's causal analysis based on systems theory (CAST).

These dig wider as well as deeper, and offer more interesting questions to ask along the way rather than just "what caused this?"
Same here. Never as big as 900 people, but I've been both laid-off and still-employed following maybe a dozen events. I have been laid off four times, both done as part of an en masse event and as a series of 1:1s. It's probably just a personal preference but I think the impersonal nature of the mass layoff is TONS less stressful. Just rip off the bandaid.

One time I was in a meeting during a "series of 1:1s" event, and a colleague opened the door and said "It's all done." and left. We weren't sure for a minute if he meant the whole company was all done, and we should pack up and go home, or if they were done with the layoffs and we weren't getting let go. It could have realistically been either one, but we ended up still having another couple years worth of paychecks.

My first time was at a startup; maybe 80 people. We had an all-hands meeting on a Friday afternoon, and everybody got an envelope on the way out. Some people's envelopes were fatter than the others. Friday afternoon was perfect timing -- most of us ended up at the brewery across the street. Fortunately in 1998 everything in tech in the area was super hot so we all landed on our feet pretty quickly.
And I see the safe languages section[1] in the WasmBoxC post; that looks like it would address most of the remaining UB risk, but Firefox will take some time getting there.

[1]: https://kripken.github.io/blog/wasm/2020/07/27/wasmboxc.html...
This reads like a solution to a twisted elementary school math problem, but:

Assuming 1 manager for 10 employees, that's 90 managers each doing a 3h20 minute block of 20 minute meetings, allowing all to be fired in one morning.
Chongli's experience is much more similar to mine, we covered basic real analysis topics in calculus classes, and the class titled real analysis was a third-year pure math course. It was designed for students who had taken multiple proof oriented classes already and were pursuing a pure math major. It's just one of those things that varies between colleges I guess.
Beyond the reasons others have mentioned, another key issue is that this isn't a transparent transformation. The sandboxed code can only access memory within a restricted subregion, which often requires some small code changes on both sides of the boundary (for example, copying input data into that memory region so that sandboxed code can operate on it).

So implementing this in the compiler would entail some fairly involved handshaking between the code and the compiler beyond the normal scope of C/C++. Doing this in a library instead — and leaning on a well-understood and well-studied execution model — makes everything a bit more natural to work with.
We're 10 days into omicron we have nowhere near enough data. But you're the one talking about long-term immunity and long-term immunity is proportional to the severity of infection. You are free to take any risks you wish to take.

If my employer wishes to pay the total cost for risking my health to work in a closed space for the sake of looking busy, and in the event of a hospitalization they will agree in writing to pay 100% of the uninsured costs, plus take out a $10 million life insurance policy in the event of my demise, I still wouldn't take the deal because I don't hate myself. But I do hate the tech sorts that think bringing everyone back into the office wearing masks all day is a good idea right now. Even Google's leadership knows that's a bad idea. Just more arguments in favor of not going to startups led by sociopathic TLAs for crumbs of the equity pie when you can make six to seven figures working for the big guys.

Further, I doubt any employer would take that deal above. They know that once you factor in the total cost it's a terrible risk. Just like unless you're a TLA at a startup you're taking a really bad deal with less than 2% equity. But you wouldn't believe that listening to any TLA sitting pretty with 5 to 25% of the pie telling you why they're going to be just like FAANG one day.

I'm a strong believer in attaching dollar figures to decisions and I know these CEOs are not continuing to allow working from home out of the goodness of their hearts. You may choose to believe otherwise of course
For high performance, HW accelerators would gain traction as that would allow them to protect the IP and provide differentiation.
It's seems clear the Fed is going to raise rates at some point, but the question is "by how much".

I doubt the market will be affected too much if rates are increased yet stay below 4%. Many houses in my local market are selling in under a day; a small increase in mortgage rates won't tamper that demand to any great degree.
Do you have any recs for the right filter and sensor?
Great question! Dates and times are one of the most loathed obstacles in writing software that needs to work a particular way across millions of devices situated all across the globe in different regions and time zones.

In our case, we had a bit of code that aimed to measure the time until midnight/tomorrow. But when clocks change at midnight (jumping forward or backward), you can wind up with days that appear to be longer than 24 hours in length. And when a day is more than ~24hr in length, you wind up with unexpected answers to seemingly simple math equations.

A bit of logic, responsible for setting up a timer, wound up scheduling numerous timers when our 'How long until tomorrow' code began returning negative numbers. That set of unintended timers locked-up the application itself. You can see our issue for the behavior here: https://github.com/brave/brave-core/pull/11030.

For 10 minutes of anxiety, check out 'The Problem of Time & Timezones' from Tom Scott of Computerphile: https://youtu.be/-5wpm-gesOY. It's a fantastic summary of the issues programmers face when dealing with time :)

Sampson (Brave Team)
I disagree: some "collective overfitting" happens when everyone evaluates on the same dataset (and often, the same test set).

There's a neat set of papers by Recht et al. showing results are slightly overfit to the test partitions of ImageNet and CIFAR-10: rotating examples between the train and test partitions causes systems to perform up to 10-15% worse.

https://arxiv.org/abs/1806.00451
https://arxiv.org/abs/1902.10811

There's another neat bit of work involving MNIST. The original dataset (from the mid-90s) had 60,000 test examples, but the distributed versions that virtually everyone uses has only 10,000 test examples. Performance on these held-out examples is, unsurprisingly, a bit worse:

https://arxiv.org/pdf/1905.10498.pdf
Well, I will never consider career opportunities at Better.com.
That's the cost of doing business, you keep the profits and in exchange you don't treat your employees like fucking garbage.

He didn't even need to lay them off, according to the article. He just wanted "a fortress balance sheet going into the holidays"
There is a theory I believe that its most productive to have tools that do evolve significantly over time, but not continuously. You need months/years of stability in a tool to a) learn its ins and outs and b) get value by using those learnings for a significant period of time. If the tool its constantly changing, even if becoming better, you never have time to leverage your new skills in the tool.
True, but beyond VS Code name one Electron application that’s actually good.

Companies want their application on two platform, use Electron and now their product suck on both.

Electron is actually a reasonable solution for internal and bespoke software. It just not at a level where I can see it being something I’d want to pay for as a consumer. Again VS Code is pretty good, but it’s still clearly not a mac app.
I wonder if they've ever had to enforce "Be not drowsy" or "Be in dread of hell".
Paint Me a Picture
Fair points. Sorry you’re dealing with it.
No unless you're counting browser, ide and everything CLI I install using brew
What, other than maybe Stanford, did the SV of the Baez/Dead/Jefferson Airplane, have in common with the modern SV?
Reminds me a bit of Apple's AOT protections together with Unity's IL2CPP approach.
I worked at Amazon too. This outcome of a 5 why,

"Why?" "Because our culture has product managers demanding things with short deadlines and no concern about the code quality."

Does not sound like anything would change. I could chalk up a lot of failures, missed goals or mistakes to this culture of shipping the bare minimum because that's all the time you have. Sometimes it works well, others lead to tech debt that metastasizes because the engineers don't have to use what they built leading to instances like pricing errors that lost significant amounts of money.

Working at Amazon sometimes felt like everyone was gaming the system to hit impossible numbers/deadlines - Goodhart's law at scale.
The "we" is everyone who wants to build dense, multi-unit housing based on their own assessments of how it will perform, but can't because of single-family zoning laws.

Expensive housing in many areas is a result of laws that keep would-be developers from increasing the supply, fueled by the toxic NIMBY mindset.
I was with MySQL AB in its early days, It's codebase and behaviors was much worse than it is now. Yet we had a team of people who loved MySQL and was focused on making it better.

I think this is unfortunate culture change in Oracle land - they hire mercenaries rather missionaries to work on the code, so such "I never loved it, but I worked on it for years" is not a surprise.

MySQL, MariaDB, MongoDB, PostgreSQL all have skeletons in their closet. Yet if PostgreSQL developer would be leaving with similar attitude community would raise much more to defense
44 Products by bootstrapped startup founders you can use
Is it realistic to have just 15 managers for a 6000 employee company? That would mean 400 employees per manager.
People can talk about it whenever they want, I'm only speaking in support of the very narrow point that it is unprofessional.

Stop mincing words, please.

If it's deemed "unprofessional" to talk about it, then to all intents and purposes -- "if he knows what's good for him" as the saying goes -- he can't.
Shopify helps people achieve independence by making it easier to start, run, and grow a business. We’re in the business of building useful products that help merchants everywhere. We touch all aspects of business creation—from an online store builder to retail hardware to fulfillment. Bring your big ideas and we’ll make them even bigger. Check out our open roles: Senior Data Science Manager, Customer Support - https://smrtr.io/7nRLy
Senior Data Science Manager, Operate (Remote, United States)- https://smrtr.io/7nRMv
Data Development Manager (Remote, United States) - https://smrtr.io/7jv8T
Staff Data Engineer (Remote, United States) - https://smrtr.io/7nRM_
Senior Data Engineer (Remote, United States) - https://smrtr.io/7nRNx
Often once an industry becomes brain-dead, change is made simply to have something to peddle. MS Office has been like this for decades: they simply change the UI for this appearance sake. Most changes are nothing-burgers or dubious at best. And it doesn't mean any new value is resulting. This is often when it's becomes time to look for substitutes that actually deliver the value you need.

If you don't see the value, as the customer, you are probably 100% correct in your assessment - everyone else simply is too afraid to mention "the emperor has no clothes" or isn't aware enough of what the big-picture goals and processes need to be to see that the tool is becoming Epic Fail. In general, most dot com 1.0 and 2.0 business models NEVER had the scaling to support sustained growth for more than a decade or two. MOST SHOULD GO OUT OF BUSINESS JUST ABOUT NOW.
> "I missed X - there's not enough time to check everything and I missed X". "Well, you should have told us X wasn't checked" or "you should have raised the alarm before"

You've probably thought of this, but if X is checkable, then perhaps the question to be asked, potentially outside 5 whys framework is why it's not automated. Or at the very least a checklist developed. Allowing an RCA to fall on 'human error' should be rare, not the default.

Another angle, if there is automated QA in place, is whether the go/no-go signals are good enough. Measures like code coverage can be a signal that your project is cutting QA short, and if it _is_ being tracked and shows green, that's a signal you need more advanced metrics.

In short, if management is shortchanging QA that should be in the causal path. We have an entire section on 'why metrics and tests missed the problem' outside the 5 whys just to prompt participants to discuss these perspectives.

> There are rumors of other developers being interviewed, but no one has come on board

Call me crazy, but if they're thinking about hiring another developer but not inviting you, the sole/lead developer to interview the candidates, then you're being replaced. But if they're asking you to work on vacations, then perhaps this is for the best. (Not that you're going to enjoy being laid off)

> Assuming someone does, I suspect the thinking will be "let's double the previous workload - we have 2 people now".

Well, yea. The alternative is probably to give you a pay cut. It sucks but you usually can't hire your way out of a budget crunch.
I don't think anyone can reasonably get angry over someone else following these. Good rules.
Shouldn't DirectStorage significantly decrease load times in games? IIRC that's exclusive to Win 11.
> not having to meet a single soul

Then how do you get your weed? Teleporter?
imo, the question "Why?" is really supposed to be more like "How could this have happened!??". It really makes a lot more sense that way.

[edit: to respond to the dead comment about what else "Why" could mean, the difference is the emotional valence. It's not asking the _factual_ question of how it happened; it's applying the appropriate outrage and embarrassment to the fact that it happened. "My god, we messed up! How can we ensure it never happens again, with urgency?".]
> If it's not against your company's NDAs

This ^ is nontrivial (maybe impossible) to determine without consulting an attorney.
If you can hire 900 people with personal interviews, you can lay them off with one too.
It varies. Here's an example of some performance analysis I did on the expat port: https://bugzilla.mozilla.org/show_bug.cgi?id=1688452#c37
The Steele dossier was being circulated among officials in Washington and they were taking it into account when dealing with things like law enforcement investigations into Trump. That, in and of itself, makes it newsworthy and creates a public interest in knowing what's in it, regardless of whether its claims are true or not.
No, this is not future shock - quite the contrary.

Future shock comes from "enormous structural change". As David Graeber pointed out, major structural change and scientific breakthroughs slowed down to a crawl.

E.g. we don't have teleportation, warp engines and computers integrated in our skulls. Not even flying cars. Compare it with the changes between 1910 and 1960.

Here we are seeing the opposite: endless churn and reinvention of the wheel around very minor stuff.

Graeber got a lot of backlash for pointing out this facts. We are not supposed to criticize the gods of technology.
His PhD is in Computer Science.
> My point though was that she attended college

Your point is unclear. What difference does this make? She could have once travelled to the moon, but that wouldn't make her participation in the same job worth more. The buyers of services pay for the work being done, not for what you may have done in the past. They do not care about your hobbies.

Do you think people are paying less for the software you help create because you didn't graduate from high school? Of course not. They couldn't care less. They are only concerned about what the software can do for them.

> Most tech jobs provide absolutely no value to the planet, mine included, compared to the value a teacher provides children.

Problem is that childcare doesn't scale very well. A single person can only care for so many children, especially when they are young. This means that the cost can only be distributed across so many parents. If the cost to the parents is too high, the parents will stay home and provide that care themselves.

In contrast, a 99¢ app across many millions of customers provides very nice scalability and a fortune for those involved in it. Per customer, the childcare provider is paid substantially more, but is limited to how many customers they can have.

Perhaps someone with a college degree should be using their experience to solve for the scalability issues, but a hobby one had in the past is no indication that they have interest in continuing with that hobby, so it is unrealistic to place that expectation on anyone.
Thanks for that, I did actually come across that page during development when I was searching for redesign concepts. There's a few dead links there, but it seems redesigning Wikipedia is a very popular pursuit for designers as there are tons of designs out there (on dribbble etc). I've tried to incorporate all the best ideas from these into this extension, but I'm open to any suggestions for improvements! I will also try adding this one to the list.
New York Shield Act and Nydfs Cybersecurity Compliance
OP, thanks for making this, I bet it was fun to build.

That being said, I want someone to do the opposite of what this does. Less chrome, less bytes over the wire, less predictive search, less "flatness?", less timely, more timeless.
I kinda think DRM is okay for things you rent. Rentals are not yours, so you don't have the right to repair, or copy.

I do think that there are plenty of DRM implementations that are basically malware, and those are of course not okay to force on customers.
Can you find one employee that truly works 8 hours a day?
The Western world needs to resume to exert power, or let its inability to do so be seen as a weakness, a weakness which will invite further trouble.

Burmese regime is one of world's most unruly, despotic, prolific, and it can be wiped out clean by US military with ease, without involving any of its allies. https://www.rfa.org/english/news/myanmar/military-rape-12032...
If radio equipment manufacturers built their business on choosing which messages to promote would it change things?
For those out of the loop, this is really a story about the insensitive communication track record of Better’s CEO and less about the zoom firing per se.
Oh I started to reply to this post in earnest, but discovered it devolved into a bunch of insults. Super disappointed.