skysight-inc/HackerNews huggingface dataset:
I don’t have control over MItM attacks, but Apple enforces TLS (and insists on it being robust).

I wrote every line of code in the server that manages users’ PID (which is held under conditions that would drive most HNers into fits). I use a modified variant of my BAOBAB server[0]. It’s pretty tightly bolted down. The security of the system is enforced on the server[1].

I also wrote every line of the native Swift frontend app. I use the keychain for some stuff, and persistent prefs[2] for other stuff. The keychain can live between installs, so I have to explicitly delete that, as well as the persistent prefs. Since it only holds login info for a deleted account, it’s not an enormous risk (unless the user is one of those folks that reuses passwords).

So, yeah. I’m sure.

[0] https://riftvalleysoftware.com/work/open-source-projects/#ba...

[1] https://riftvalleysoftware.com/BAOBAB/PDFs/Security.pdf (downloads a PDF).

[2] https://riftvalleysoftware.com/work/open-source-projects/#RV...
You could look at it this way - your time is worth what somebody is willing to pay for it.

If you don't have a job and can't get one, your time is worth $0.

If you get a job a MacDonalds you time is worth about $10 an hour.

If you make products, your time is worth what you can sell the product for divided by the amount of time you worked on the product.

There is no upper or lower limit. Some people make $1M a year, some make $0.

Update. The real question is, "Should I keep making furniture given how well it sells, or should I go get a job at MacDonalds?".

There is far more than money to consider in that question.
Except Ukraine isn't a "hostile fascist entity", and Putin knows that.

Ukraine is (well, sadly, was) in danger of becoming more democratically- and West-aligned, which Putin (irrationally, IMO) feared, but my take on it is that he's really motivated mostly by fallen-empire envy. (Granted, that's just my opinion; I don't know what Putin is actually thinking.)
I have no idea why you'd expect to have the right to probe around APIs like this and not be accused of malicious hacking.

You don't have authorization, you're working for a competitor, that business decided to throw you to the wolves because its easy for everyone involved to forget you ever said anything since you didn't leave any paper trail.

If I find you sneaking around in my backyard having managed to open a ground floor window I'm going to probably lose my shit and call the cops, and not thank you for discovering a security flaw.

You need to get permission for this kind of shit, and not go around jiggling other people's locks.

And the level of effort here seems fairly high and a lot more than just "view source".

The author probably deserves to lose the ability to be employed at a bank because this was some pretty bad judgment.
Good MVP. I wonder where this will lead.
More accurately, machine generated works with no human involvement.
Who wants to bet this testimony will be exhibit B?
> If you're referring to the author's use of Charles Proxy, it's *not* an anonymizer

I am not, I was referring to the suggestions broadly shared elsewhere in the thread of doing this anonymously instead.
Russian Pilots Have No Choice But To Fly Straight Through Man Portable Missiles
Fed profits (after paying out their 6% shareholder dividend to banks) gets remitted back to the US treasury. With a captured Fed, this is nothing but the government printing money to cancel their debt, with an extra step where banks skim some of it off the top.
Mods: please kill this post, for the sake of the poor person going to court soon.
I'm not sure. It sounds like a genuinely neat idea for another TUI app though! Make the files .text too files instead and build and index of them for searching.
404'd. That was quick. Seems like he took advice of some in this thread.
Oh dear. That is quite brutish of them.

Try contacting the CEO of Stripe.
Only one of them needs to work to be good enough.
PostmarketOS v21.12 Service Pack 3
These arguments are missing the point completely.

Once we abolish the changing of the clocks we’ve gotten rid of a societal menace.

Then, any state can switch to whatever time zone they want. If the Pacific states want to move an hour, go for it! Just so long as none of us need to move our clocks twice a year.

It literally doesn’t matter if we decide on Standard or Daylight time. Daylight seems to be the preference of the East Coast. If some states on the western edge of their time zones don’t like it they can move 1 over on their own. We need to abolish the nationwide clock changes because they’re nonsense.
Russia is supporting murderous regimes all over Africa right now, which is why so many African nations abstained from the Ukraine vote at the UN recently.

Russia has been propping up the brutal dictatorship in Syria for a very long time, and several others before it across the Middle East. It has also propped up both the Belarus dictatorship and the authoritarian regime in Kazakhstan, and those are merely very recent examples.
I think you could be right.

This isn’t some “right click view source” nonsense.

OP put in some decent amount of effort into compromising the bank’s system. A judge and jury will not understand this, even if they are a computer literate power user, and even if they work in IT in a non-security role.

I also assume that OP is telling their side of the story in the most favorable way possible, and could be omitting some details.
I guess being in the security business changes my perspective on that a little. I'd not expect a competitor to specifically try and hack us, that would be quite the middle finger from their side, but if they come across something and disclose it then I'd send them a suitable thank-you gift (maybe some beer, depending on what they like) and a nice card.
I suggest adding something to your profile about that research. AT Drummond finds nothing useful on Google or Google Scholar.
Directly informing the effected bank and then informing your then employer would've been a better solution? I think it has the highest chance for least negative repercussions. I assume it would still go a bit wild, but have the least negative impact. Obviously I could be wrong.

You need to keep in mind that security disclosures and everything around (legal, why disclose? etc) it is a black box for most folks.

Also OP said after reporting it, "months later" OP was fired. This means anyone in those months anyone could've found what the OP found and abused it. And the effected bank might've not been involved until later? And all those crimes are now on your shoulders. Your then bank employee would get delayed through the politics in your company (even with good intentions). It will happen even for their own security disclosure handling. Let alone for competitors cos so much legal stuff are involved now.

From the effected bank's POV, you are just a bank employee who did some fraud. Mainly cos you didn't inform the effected bank and it's been months. Insider hacks from the same industry is not unheard of.

Like I said, this would've been a different scenario if you informed them ASAP. And I am sure when issues hit the roof your employer would wash their hands off. It is the easiest thing to do. Unless you are very well connected in the office. Otherwise even your employee are not sure about you. They will be asking questions like, why is this person doing this anyways? He is not in security so why was the OP poking around it? etc etc.

Hope this gets sorted out. Interesting case indeed.
> I eventually realized my motivations for developing open source software were rooted in vanity.

Very insightful, but is it in fact a slightly different emotion to that?

In the Mythical Man Month, Fred Brooks says:

> Why is programming fun? What delights may its practitioner expect as his reward? First [..]

> Second is the pleasure of making things that are useful to other people. Deep within, we want others to use our work and to find it helpful. In this respect the programming system is not essentially different from the child’s first clay pencil holder “for Daddy’s office.”

I don't know if this is quite vanity. That sounds a bit too negative. Is this the kind of complex emotion that Germans would have a word for but not English?
Washington can easily vote to move their time zone back an hour if they’re not happy with DST.
Yes I'd love to learn more! What would be included in the onboarding process?
Thats the reason why you everytime anonymize your accesses, don't tell anyone from your findings that has nothing to do with it and sell the shit in a bug bounty or on the darknet.
And if there is no one who will give you money for it, make the most damage you can to make clear that it's a financial risk to deploy insecure software.
Can't you and yours just freeze at go 1.7? That way, you get your diversity. Pretend every code base that's using go 1.8 is using java or something. A lot of us who write go everyday think generics aren't complicated and are tired or repeating ourselves.
'wkeism' as a tool reminds me about authoritarian states introducing laws that are impossible not to break by design and then applying them selectively to obliterate any dissent.
https://web.archive.org/web/20220317003600/https://accidhack...
It's hard. You can love and be excellent at all the things a field of study entails, but if no one wants to pay you to do those things it isn't a career.

I think encouraging people to study and enjoy these things as a hobby, and providing a solid, structured way to do that without it being a full career, would go a long way. I used to love literary criticism, but I sure as hell couldn't have made a career out of it and I don't have a super obvious path to do it as a hobby that doesn't require a bunch of self starting many people will have a hard time with.
You can create a role whose sole job is to switch to the roles needed. Doesn’t require you to escalate to superuser-level privileges that way. But still, if SQL injections aren’t properly considered then it’s possible for a user to gain more privileges than planned. Although SQL injections are usually mitigated by the DB libraries these days.

Also, it’s more convenient to use SET LOCAL ROLE <ROLE_NAME>, since that only keeps the role for the transaction. Manually resetting it is error prone (IME), and forgetting will have the supposedly “temporary” role bleed to the next transaction.
I wish I was a """cancelled""" billionaire living inside a literal castle.
I don’t think anything will change until large development firms pressurise popular projects to stop the behaviour.

I hope you speak with executive and lead developers to highlight the volatility of the ecosystem, like I do, every chance I get.
Lol the audacity to say any of this. The only mistake this dude was trying to be nice to either of the two shit companies he worked for. A fintech created a shitty shitty app and released it to the public and you accuse this guy of “jiggling” the lock ? He should have totally released this info on 4chan and let the wolves do their job.
What that’s describing is the desired time zone in winter.

If a state decides parents matter more, they can move to the time zone such that parents are happy in winter year round. No need to change the clocks!
Ask HN: Anyone have stock option horror stories?
How much money did you lose exercising? How much taxes did you pay in paper gains?
I'm not talking about armchair experts, but people who have demonstrable competency that doesn't happen to line up with the prescribed ladder.

It can also go the other way as well. Someone could have extremely strong technical skills with little interest in searching for new problems, so they don't tick the box for Staff even though they can provide an enormous amount of value by tackling known, hard problems.
> The two countries were previously part of the Integrated Power System that also includes Russia and Belarus. This made Ukraine dependent on Russia's grid operator despite there having been no electricity trade between the two countries for years.

Can someone explain what this actually means and why this is needed? It seems it's not about the actual power supply itself, which the last sentence indicates was already not dependent on Russia. So why does Ukraine's grid need to be connected to that of other countries, whether IPS or CEPS? They indicate it's useful in case the power infrastructure in the country gets destroyed, but I don't understand in what way.
Absolutely. And if it winds up being a shitty time zone for your area, switch time zones!
>Serious question: are internet cafes still a thing?

I live in a capital city and am aware of at least three of these still kicking around.
I think you misread the post. The author is not telling you to go to bed at 10 etc. what the author is doing is not diff then one going to a grocery store after it’s service hours. A closed sign at the entrance doesn't mean you need to be in bed. it’s simply stating you can’t do business with them at that hour.

Majority of the physical stores work this way because there are real people running them. It’s just that digital stores never worked this way it generally thought they are run by computers - which is mostly true but at some point if there is a need for human interaction one has to wait. At least until they are completely run by ai and robots. And that applies to physical stores too :)

Ps: I have kids too and know what you mean
> The way it is described is 100% legit pen testing with public data and endpoints and no malicious use of vulnerabilities found.

"legit pen testing" requires consent from the owners of the system being tested.
Didn’t RISC-V put the final nail in the Mill CPU coffin? (I think Mashey put the first nail in decades ago?)
No he is just still hardly naive and thing he can win without to shaming both enterprizes for the shit they done.
Go 1.7 is still around. If people can still run python2, by all means, keep fighting the good fight.
It will be interesting to see how the dynamics change as the USD loses its grip on the crude oil trade and possibly other commodities as well. Will the US keep doing these money-printing and interest rate interventions for the next shock?
I guess it depends on where OP is located, but most US states have at-will employment, and being a hacker is not a protected class, so I don’t see how this could be an illegal firing.
I might be, I suppose. Without going into details since this account is trivially traceable to my name, this wouldn't be the first thing the Internet tells me to never pull on my employer that went swimmingly. I do have some faith in my boss; it's a small company and security is a small world, and rich enough to not need backstabbing and politics a lot, thankfully. And I've got access to sensitive customer information on a daily basis (unpatched vulnerabilities), some trust is required in this field. If that wasn't there, I'd never have been put on projects or at least not lasted for very long.

Also note that I'm not in the USA and it's not this 2 weeks' notice wild west style employment (from my point of view).
This is effective because when depressed, you imagine you have no agency. It's helpful because it's something you can do as soon as you decided to do it, that improves your environment and proves to you that you DO have agency.
Hey now, they said they wouldn't want their employees doing it, not that they'd forbid employees doing what they will with their free time.
I think I would've felt better with a half point raise.

Remember, the Fed called inflation 'transitory' for quite a while, even as others pointed out it seemed here to stay. They may not be giving it the respect it deserves.

I'd be delighted to be wrong, to watch inflation fall with the smaller raise. But if it fails, I hope they move aggressively against it soon to stop it.
Open source involves community. This was a website for people that actually do make Fedora. If I make packages for a Linux distro, or content, can it not be said that I help make it? Same for Windows as well. If I contribute packages for Winget or contribute on their GitHub to Windows Terminal then that is not wrong as long as I don't pretend to be that company on the site itself or represent the company in the actual content. A domain name means very little, it is the content that counts the most
Whatever they do is not working, we built feature to make sure stripe is not losing money by covering negative balances from as budget automatically but they blocked us and didn't pay
> This came up when a gorilla grabbed a camera and took a selfie. As I recall, it was deemed no human was involved so the picture was not copyrightable.

No. Nothing was deemed because the photographer didn’t sue Wikimedia for copyright infringement. Had he done so, he very likely would have won, as setting up the conditions to ensure that the monkeys would take selfies with his camera is almost certainly sufficient human involvement.
Could you elaborate? I can update things just fine with a combination of USING, and WITH CHECK. USING can imply WITH CHECK too IIRC.
> Basketball and baseball are both extremely popular in many countries outside of the US and Canada.

Basketball, sure. But:

> Baseball is one of the most popular sports in at least Japan, South Korea, Taiwan, Venezuela, the Dominican Republic, and Cuba.

Where "at least" is also simultaneously "at most", AFAIK. Six is not exactly "many". And, hey, since you're writing from an American perspective, Cuba doesn't exist, so it's only five. And Venezuela? Four. Taiwan will probably be part of the PRC soon, so we're down to three... And how significant is the Dominican Republic, really, in a global perspective? So you're left with pretty much just Japan and South Korea. And are any teams from there even in the "World" Series?

So, sorry -- and yes, I'm from Northern Europe and everything -- but you guys really make this "typical reverse-American-exceptionalism sneering" all too easy all too often. :-)
Ah I misinterpreted that you were talking just about your app, my apologies.
I didn't mean to call you out on that. I'll update my comment to reflect that.
Unfortunately, you gotta have the wisdom to recognize the politics and thereby protect yourself. To know when it's just not worth it. Sad but true
About 20% of passengers on a flight typically catch a cold (rhinovirus). I researched this issue several years ago because it was quite a problem for me. After I began following hygienic measures, I rarely caught a cold. I made a recent comment regarding this (https://news.ycombinator.com/item?id=30539411).
Have you ever worked in a code base that was clean of UB? If so, are you SURE? By the way this is not a question I ask of any other language on the planet.

The fact is, you have to carry the cognitive overhead of UB even if you write everything correctly, because in the world of C the compiler it can almost be considered an antagonist if it can get 5% faster.
it always is a comfort to know that the alphabet boys did bad things in the 1950's, 1960's, 1970's, 1980's, 1990's, 2000's but are actually totally chill now
I'm in the habit of keeping a text file with all software I've installed and updating it immediately. Really helps remember stuff like this.

Also I use dmenu and a script for using aliases in dmenu, and I create aliases for popping them out in new terminals. Really fast workflow.

If you're using a lot of tui stuff changing workflow from double click to launch really makes the whole experience smoother, much smoother than GUI stuff.
Reminder: Docker Desktop is not free software (it's not even source available) and has embedded spyware that uploads a ton of sensitive info from your system without consent when it crashes.
> Banderite Ukraine

This is something that... doesn't really exist today? I mean, sure there are still nazis in Ukraine, even in its government and military, but by and large it doesn't seem that they're anywhere near a majority or have significant influence... despite what Putin's propaganda would like us to believe.

> IOW the "fascism" part isn't necessarily bad (unless you are a liberal chauvinist)

If you truly believe that, I don't think you're going to have a productive discussion on this topic here. Most people here (myself included) would not characterize hard-right authoritarianism that way. I believe that form of government is objectively bad for the people under it, at least those outside the ruling class.
I love the idea we will soon have western and eastern open source projects. Even if internet isn't bifurcated, both sides will be too paranoid to install software from the other side. All software projects will have to pedantically vet every line of a commit, photo ID every contributor, to avoid subtle bugs intentionally committed and sent to millions.

Why stop at countries? How hard would it be to use ML to detect if the user has the wrong politics? Why stop at just deleting files? How about downloading as much illegal content as possible, sending embarrassing emails, etc? There's so many possibilities here.
Yes and that would potentially allow the (human) creator to get copyright on the creation.
Socialism was tried in many places, but it's self-destructive - it's all about big and powerful state, which immediately gets exploited and ultimately perverted. It's impossible to implement a human-managed socialistic economical system. Maybe if machines managed it, it could work - but I'm in no hurry to try.
The technical person should just anonymize his accesses and make the most damage he can. Lets financial loss find his way into the brains of the dinosaurs.
Even if they are a reprobate they deserve fair treatment.
Yayoi Kusama
Never said TCJA or the Bush era tax cuts were used for good purposes :) but it's probably better for the country in the long run to have excess money flowing into tech VC funds rather than being spent on memecoins and shitty electronics. That way maybe 1% of the funds will have positive returns rather than all of it being set on fire.
> I do security for a living, this is exactly how I'd have handled it and how responsible disclosure is supposed to work.

Assuming you're in the USA (might be an incorrect assumption) I'd strongly recommend familiarizing yourself with the CFAA and how "improper access to a computer" has been legally interpreted.
Quite possible that it's a pseudonym.
*asserted authority over
One of the reasons that I like working there.
In Korea, defamation is a criminal charge and you may be sentenced to 5 years in jail if guilty. As a lovely cherry on top, truth is not a defense, although it does lower the maximum sentence to 2 years.

https://seoullawgroup.com/defamation-laws-in-korea/
Largest wooden rollercoaster in the world in Poland “Zadra”- Polish for Splinter
Sounds conspiratorial/not my experience doesn't mean not true. Humans are great at conspiracies. The word gets used dismissively because paranoid types claim conspiracy without evidence and experience. If you went to your local court you'd hear about many people witnessing conspiracies
$5b seems pretty low to me to be honest, especially given the way tech valuations work.
Airbnb's Pledge to Host Ukrainian Refugees Gets a Reality Check
Googler, opinions are my own.

I think this is done as a way to do "in app" purchases that don't flow through Google. Tap-to-pay cards are effectively single use (due to the cryptogram that gets passed with it), it won't store the card with Lyft.

The other way Google does integration with 3rd parties is the "Pay with Google" button on websites, that will vault your card on file at Google into stripe or braintree, then the merchant can use that for a transaction.

Both of these methods move the liability of the payment onto the merchant (Lyft in this case).
I wonder how things might change if he distributed something like Fedora but with malware. I hope in that case he'd not prevail in a legal battle over use of the name 'Fedora'.
what-about-isms often bother me too. That said any commenter that excuses the CCP because of US dalliances is way off base. I'd say that there is some value to pointing out that unelected agencies both domestic and foreign do this stuff to US citizens.