skysight-inc/HackerNews huggingface dataset:
(Sorry about the substantial edit after you apparently already read my comment. Most of the time people don't see it that fast ^^')

> at a big US pentest firm I think it'd be hard to do public reports any other way [...] You'd have to let [clients] see the report before you could write a version of the report for the public, so you can scrub out the findings that don't pan out.

We do let them see before, also because there is indeed time needed to roll out fixes, but we aren't often asked to make substantial changes (and if they ask, whether we can oblige depends).

Sometimes we make a real mistake and then it just looks silly for both parties so that would be removed, but usually things are just factually correct. For example, we can't always know about backports when we see an old version (and PoCs / detailed info is notoriously missing from CVEs, one of my pet peeves), so we recommend they check that the thing is up to date and implement an update procedure if it's not. That advice is valid no matter the actual state. We can mark it as checked and OK as part of a retest (if we got ssh to see for ourselves, or we would write something like "$customer checked and says it was up to date" as the retest description alongside a 'resolved' marker).

> Another obvious issue is that reports often include tentative findings,

Is this like an int overflow that you're not yet sure is exploitable or so? Or do you have an example of this? I'm not familiar with the concept of a tentative finding unless it's like a little note "this search function at /search.php produces a weird error with input {{1+1}} but I haven't found a useful bug yet, todo investigate more".

If it's the latter, we don't report those if we couldn't find anything clearly wrong with it. If it's just not following the spec (HTML entity encoding issues are a common example) but we don't find a security flaw, then it's an informational note at best. Maybe we should be more pushy with these in case it turns out to be exploitable.

> the question that started this thread was whether having Google breathing down your neck would make this a hard engagement to deliver, and I think the answer to that is almost certainly "no".

I mostly agree there. It's definitely a bit more work with our process because what the test team sends out for internal review is supposed to be basically ready to publish, so they'll do more double checking of the facts before git committing the finding and such. But at the same time, because the routine is almost identical for private and public reports, it's not very special even for big customers that people here would recognize.

Is the engagement harder? Slightly, because you don't want to make the firm look stupid by doing something wrong. Does it qualify for the statement "hard to deliver"? Nah, I agree that this answer is "no".

> the stressful part of this engagement would be coming up with a report that never gets anything more than a sev:med

This. Or even nothing above 'low' if the attack surface is small and the devs are up to date on the relevant security best practices.
Ugh, this isn’t a great format for a submission and I think the discussion here suffers because of it. Probably would have been better as a text submission with two links and a description but then they are maybe hard to click.

I don’t really think this is very interesting. The comparison here is:

Minimum spec 13" MBP < iPad Pro + larger size + next rung up in memory. But the difference is pretty small (<1%).

I guess a few things are going on:

- pricing may be adjusted based on demand / whether new stock must be imported.

- Apple tends to price the basic model cheap with the extras (often just more memory) at a large premium. So the MBP is cheap pricing whereas the big iPad with extra memory is not.

- the 13" MBP is a weird model and not one that most people would choose. In particular, it’s still using old case designs and keyboards and Touch Bars and suchlike. I suspect this is part of why it’s cheaper than the other MBP models. Most people would choose the new Air or the M1 MBPs with the bigger processors, newer (pre-2016-style) keyboards, and better screens.
My 2FA is all using Yubico Authenticator, so even TOTP codes are on my Yubikey rather than my phone. I keep my backup codes in 1Password in case I lose my keychain.
> „environmental brightness“ (don’t know the proper term)

"Ambient" brightness. You were close, and that term worked well enough!
Unicode 6.0 added this emoji and three more (for GBP, EUR and JPY): https://emojipedia.org/dollar-banknote/
That's not really a good excuse for leaving the bootloader locked? Adding iPads as a supported hardware target for MacOS is trivial (especially on the Pro models) and it doesn't degrade either experiences. Plus, they'd do a good job shutting up the row of people like me who want to see all their hardware get unlocked.

Obviously their main motivation is control over the product, but I think an open bootloader is a completely sane request for hardware you own outright.
Does anyone know when this language will be ready to play with?
Only thing you really need to do is go outside because of the sustained bright light exposure. Everything else is kinda moot.

It’s why it’s important for kids to spend a significant amount of time outside. Your eyes degrade due to low light exposure. Even well lit indoor spaces are incredibly dark compared to the outdoors. Your eyes were made for the outdoors.
Same here. I also switch to light mode when I'm in a very bright environment and it seems to have helped a lot with eye strain since last year. I feel like these studies are being a bit 1-dimensional... but then again, maybe that's my own confirmation bias.
A big problem seems to be that the signatures are growing as the public key ages. After Merkle tree leaves are full, the remaining one would be used to sign the next Merkle tree, and when that is full, the next one. Thus verifying an aged public key signature would require verifying the signature chain, which authenticates the current Merkle root.

I wonder if this would be the only signature primitive, how the internet infrastructure could have worked out. Having a large number of leaves for a Merkle tree seems a prerequisite. But then, to limit verifying aged keys, some form of key renewal authorities would be needed, which would be trusted by verifiers. But at that point, would it be better to use MACs?
I just think dark mode is prettier.
Not in my house. Dirty clothes go into a hamper, the bag comes out of the hamper to the laundry, and then the basket is for carrying them back to the bedroom to fold.
> IME people after getting whatever they’re working on to pass tests don’t feel like writing prose about their work.

Communication is part of the job. How many well-paid and creative professions get to just "nope" out if their responsibilities like that?
You can also do something similar with WordPress plugins.
> I guess each digit is a word?

In many cases each word has a number/token associated with it, but some words get broken up into several tokens. Same with longer numbers.

You can check out their tokenizer under the following domain. It probably gives you an idea why GPT is not very good at dealing with numbers.

https://beta.openai.com/tokenizer
Thanks. Using filler words is one of those things where it's easy to notice when editing or listening to it later but near impossible to notice in the middle of a regular conversation. I do try.

You are right. I do come into each episode with a number of high level bullets. I always try to stay on track so each episode flows roughly the same. Basically (:D) learning a bit about the service, team size, how it's built, how it's deployed and lessons learned. If some of these get skipped, it feels like an unfinished story that goes against the premise of the show? It's interesting to hear you think otherwise and would rather go deeper on a smaller subset of topics. I thought maybe that would make it even more niched down.

I'm happy you brought up the part about tech choices. I do try to pry out the "why" on a number of decisions. There's a fine line here. I kind of wonder which episodes you watched because I thought I challenged them kind of a lot but I definitely keep myself in check to avoid coming off too combative even if they are asked in a friendly way. But I did try to always call out questions that I really feel most listeners would be thinking.
It depends how you do your laundry I guess.

I have a washer-dryer combo (and enough solar power to not worry too much about the environmental impact of using it). My wash involves chucking everything in the machine at the end of the week, waiting six hours, carrying the now completely dry clothes to the bedroom.
The mass extinction of Unix workstations
I didn't say it but I was talking in the context of a standard office setting that most of us probably work in.
Depends on what negative effects actually manifest
There are ad blockers available on iOS.

https://www.imore.com/best-ad-blockers-iphone-and-ipad

I don't know how the functionality compare to what you are using on other platforms but ad blockers are definitely available on iOS/iPadOS.
around 500 words. quite long!
>>>> Increase sample sizes and lower the significance threshold to .005.

I'm a physical scientist in industry, so I don't publish, or use p-values. But if the familiar "square root of n" rule holds, than a 10x improvement in any kind of "noise" measure requires a 100x increase in sample size. This is probably impossible for many kinds of experiments. Even in my work, desiring such an improvement usually requires me to scrap an experiment and come up with a better one, rather than slogging away to collect more data.

Worse, we may suffer from the fact that for some kinds of studies, sample size is limited by the number of potential subjects per researcher. You can only ask undergraduates to do so much. More researchers in the field means weaker statistics.

A possible minor improvement is to eliminate the requirement of publishing a masters thesis project. My friends who were psych grad students all had to do a master's en route to the PhD, and it had to be published to fulfill their requirement. This might have seemed like a quality check, but instead created an incentive to load the literature with low quality research. And many of the students were not looking forward to research careers anyway. Their term for finishing the degree was "published and outa here."
Yet it's hamstrung for programming by completely arbitrary decisions on Apple's behalf. That's why people are mad, not because we struggle to visualize times when a locked-down tablet can be used.
Last time, they got something like 80% return on the laser energy input, now it's over 100% apparently. And, they had trouble repeating that last record, so people were questioning how meaningful it was if it couldn't be repeated. Now they've been able to repeat it & improve on it.
I get that to some degree, but that code doesn't look like something most people are exposed to, whereas 'x = 10' or something that says 'foreach' seems like it'd make sense with a minimum of explanation to a lot of people.

x:=(1|2); y:=(7|8); (x,y)

Doesn't look like any math I'm familiar with.
Not if you've also got a tumble dryer
> 1. restore trim to normal with the electric thumb switches on the column

That's probably not an easy thing with a computer undoing your work every few seconds and fighting you for control.

And they did try to correct the trim before moving to 2.

5:40:00 AND (here automatic nose down) activates for 9 seconds, computer trimming from 4.60 to 2.1 units, crew trying to counteract by pitching up.

5:40:14 Pilot begins adjusting trim up. Gets to 2.4 units.

5:40:22 AND activates yet again (7s), also pushing trim all the way down to 0.4 units. DON'T SINK warning and PULL UP.

5:40:29 Captain asks the First-Officer to trim up with him. They reach 2.3 units (9s). This interrupts AND.

5:40:38 stab trim cut-out

5:40:43 AND activates again, but at least now it leaves the stabilizer alone.

All in they did fine, considering all this happened in 40 seconds. They regained control of the aircraft and now have time to asses what even happened.

However they still have to apply up to 100lbs of force to keep the nose somewhat pointed up. Only at times when both of them are actually pulling on the stick does the plane gain altitude. On top of that they're getting a MASTER CAUTION "anti-ice left alpha vane", adding to their workload. In the next three minutes they're discussing the warnings they're getting, informing ATC of their problem, and are trying to manually trim the plane (which doesn't work). I'd imagine their arms are getting tired.

So the understandable next step is to switch stab trim cut out back to normal, then trying to correct the trim further.

5:43:11 stab trim back to normal, followed by some short manual electric trim inputs

5:43:21 AND triggers yet again (5s), stab to 1.0 units. Within the first 3.5s the aircraft pitches -8° down, descent rate increases to -5,000 ft/min.

If they had caught and interrupted the AND/flipped stab trim back immediately, maybe this could've been saved. But since the computer got to do its thing for a few seconds, it's pretty much too late to do anything. The pilots are applying up to 180lbs of force, which accomplishes nothing. The plane keeps pitching further down.

5:43:44 Plane impacts the ground at an angle of 40° nose down.

That whole timeline was 3 minutes, 44 seconds.

The only way you can reasonably expect a human to deal with a situation like that, which requires a quick response, is if you train them for it. You don't just give a vague warning, a bunch of steps with three IFs attached, and hope for the best.

More complete, interim, report: https://reports.aviation-safety.net/2019/20190310-0_B38M_ET-...
Failure to improve forecasting skills is valid criticism, but that doesn’t amount to bad faith.
oh that's a fun idea! need to figure out how to handle totally inappropriate content but...
Just a few days ago I found a serious security issue in SQLite: https://sqlite.org/forum/forumpost/07beac8056151b2f

It was also promptly fixed, but it makes me feel like the millions of tests sound better than they are in reality …
Not movies but worth it:

- Devs (also by Alex Garland, director of Ex Machina) - admittedly doesn’t fit suuper neatly with the other topic recommendations but you’ll probably like it

- Can’t Get You Out of My Head by Adam Curtis

- Westworld
> Now, recently I had a startling realization: it's actually easier now to get many of the games I love running on Wine (with or without steam) than it is on Windows. The performance is great.

I find this hard to believe unless you are talking about older or indie games.
Courts are oblivious to equity and other non-salary compensation?
There's every chance this is microsoft's fault, but bluetooth is also an ungodly mess of hacky junk that seems to get patched just enough to work with big hardware vendors, and then forgotten about.

My theory is that the bluetooth hardware community doesn't have any rigorous testing suite for compliance with the spec. Instead implementors just test with a few other vendors' half broken implementations of the stack, and then they patch their own hardware just enough to make it work and release things.

I bought a bluetooth keyboard and mouse a few weeks ago (both from different vendors). Neither device works over bluetooth on my linux workstation. I can get the keyboard to work by running some random commands I found on the internet, but it stops working when I sleep my computer. (A suddenly broken keyboard is the worst kind of surprise). The mouse has never worked over bluetooth. It just spits errors into my kernel's bluetooth stack.

Both devices are just plugged in via USB cables now.

I suspect linux's bluetooth stack is spec compliant, but its missing all the dirty workarounds for broken hardware that exist in macos and windows.

Anyway, Microsoft shouldn't have broken your headphones. But Bose is probably just as much to blame.
How can they possibly have enough precision in their measurements of all the other sources of light, from galaxies to dust on the ecliptic, to be confident of such a small difference from zero after subtracting them all out, when the measurements of all those light sources are affected by this thing they've claimed to find? Not saying it's impossible, but if they did it, that's a heck of a story we're not getting at all.
Which guideline is that?
I belong to neither of the groups you mentioned. The only responsibility a parent has is to their child - there is nothing contradictory or lazy about this.

Otherwise you seem to project personal stuff I have no opinion on.
Just a heads-up: Make sure to have enough time to mess around with it because it's a massive time drain. Especially if you like sound design. Exciting and fun time drain, but a time drain none the less.
He was smart in the sense he knew how to best exploit his engineers and take credit for their work.
Tentative findings happen all the time! You get partial code for things, or you get the code for something that sits in front of some service you don't get the code for, or the environment might not allow the input that you've determined from the code might be a vulnerability. Or, to flip the script: you're primarily testing and not reviewing code, and you come across weird behavior --- a timing-variable 500 response, for instance --- and you don't have log access. Even when you have complete code, if you fuzz the target, finding the code that could have generated the exception can take days, and it's sometimes better to doc and move on than to waste time figuring something out the client can work out in a minute.

Another class of tentative finding: authz issues in very complicated enterprise software, where your "supply clerk" user can get access to some "inventory list" data that the ACLs suggest should be restricted, but it turns out that supply clerks are just supposed to have access to this stuff.

A lot of crashers are also tentative findings. Is it memory corruption or is it a null pointer dereference? That's the difference between a sev:hi and a sev:info.

But, like, again, I'm a pentest nerd, and I'm super interested in processes that are deliberately honest about public reports. I think public reports are pretty problematic, even from firms that I like. So don't read me as pushing back on you, you've just perked my ears up.
You seem to be responding with pretty thought-through responses, so I thought I'd ask you this: Given some people have mentioned its possible the confusion happened due to a "dark pattern" - i.e. a deceptive UI choice, or one where the concequences of what things do are not labelled in a seemingly deliberately confusing way, what is the thinking behind this at microsoft? Is it something they would consider changing if enough people struggle with it? How do things like this happen - I struggle to imagine that product developers on the windows team use these default apps themselves. Surely there must be internal dissent about such things?

I've been facinated by microsoft in recent years, they are really putting in a jekyll and hyde performance imo. They are consistently great at developer relations in some areas, with things like generous contributions to hackathons, visual studio code, github copilot, visual studio etc. But seem to make decisions in other areas, in my opinion particularly around the OS team, that needlessly antagonize a lot of people.

If I were living in a place where they had offices, working for MS is something I might consider one day, if only to be able to contribute to such important things that so many people use daily but I feel like I bounce back and forth on this opinion when such confusing decisions come out with seeming silence from microsoft's end.
Second Passports- What are the best ones?
Passports used to be a simple tool of convenience. Rulers would give their subjects a set of papers to show to another ruler asking for their safe passage. Now they evolved into what they are today. Second passport can be a great way to open up your options. I wrote about it in RNW!
In my uni they still teach C++ as a first language, that's why the "don't learn it as a first language" got me confused. The core language is very useful for learning programming, it is actually very clean.
One problem with this I can see is that it's quite easy to write a delta that's larger than 4096 tokens minus prompt length (the maximum amount of context gpt-3 can process), and if the delta's so short it's less than that then it's not particularly necessary to use the AI to generate the commit anyway.
Several years ago, after reading about how claims of dark mode being beneficial were usually bullshit, I switched to light mode for everything and just making sure I have lights turned on where I'm at. It's great!
Also this is not even a silent bug, so I would have expected that this would have been caught by someone in production.
Not sure how much winds up in cosmetics, cleaners, lubricants and stuff.
Well said.

I’m not sure when we crossed that threshold where actively trying to limit technology in a fair and automated way access became “lazy parenting” but I don’t like it.
> driving a used car might produce more CO2 (Which the author is alluding to as being dirtier after X years of ownership) but has none of these secondary effects.

You're comparing a new EV to a used ICE car. Brand new ICE cars have similar pollution to brand new EVs. Sure, second-hand cars are better. Second-hand everything is better for the planet. But the world is full of people who will continue to buy brand new cars off the production line, and for those people, an EV is ultimately cleaner.

And for you and me, there are second-hand EVs out there which are even cleaner again than a second-hand ICE that continues to pollute with every mile it drives.
Bluetooth is still the one missing though, specially for audio. I'm not going back to Windows though, no matter what.
> There is literally no valid reason

A huge engineering lift (drivers, etc, as well as Apple's high QA standards), for something almost nobody would use
It's a geo-fencing / DRM / regional licensing restrictions BS problem. HE is innocent, and Netflix probably doesn't have a choice* (though arguably what should matter is the bank account location of the buyer).
Yes, my eyes don't hurt anymore, my vision has improved, and I sleep better. I won't go back. Reading condescending insults and "reasons" (in dark mode...) that flatly contradict direct experience won't change that.
Will Twitter's "metaverse" converge on VRML and let you and your assisting A.I. visualize the abstractions on fly through with the option to zoom to textual source overlayed with "field lines" to grasp the contextualized gestalt, low and high brows are within dynamic range?
It's a bit more than that - the Russian part of civilisation came _from_ Ukraine. Kiev is much older than Moscow, and that's not something Rashists can forgive.
Filtering out snobs just sounds like a bonus.
It probably got a lot easier with ChatGPT now.
Yeah it's not either/or, you really want both.
The answer is obviously—no it’s not! Neither is light mode. Screens are bad for the eyes.
Not a podcast but an episode of a podcast called Adversarial Learning Episode 10: Stories of Degradation and Humiliation. https://adversariallearning.com/episode-10-stories-of-degrad...

I wish there was a podcast like this episode. A single host and new guests on every week to share their stories of bad interviews.
> Its the only way I can think of that space cargo becomes economical

Depends what you mean by economical, but a totally, rapidly reusable craft that takes mass to orbit would massively reduce the cost of getting mass to orbit. Not as inexpensive as a space elevator, but more achievable in the near term.