skysight-inc/HackerNews huggingface dataset:
New OpenGL 4.4, OpenCL 2.0 specs
It's entirely reasonable to say that the lead explanation is "reaching," although it may turn out to be true.

My standard is that I don't use phrases like "reaching" unless I either am quite positive of what I will say, or am somewhat certain then did a Google search to verify.

You're equivocating here, intentionally. The question is whether it made a difference in crime, not whether it "made a difference."

I assure you that any equivocation was absolutely unintentional. I have been aware for years from http://www.washingtonpost.com/wp-dyn/content/article/2007/07... and other articles that the correlation between lead exposure and criminal statistics has been examined and proved very strong. And, of course, we have the known causal links between lead exposure and behavioral problems that could potentially lead to criminal acts.

Thus we have strong evidence of both correlation and causation between lead poisoning in childhood and criminal behavior decades later.
Aren't flights from UAE to Iran super frequent and cheap? I'd just fly to DXB or AUH (ideally, Etihad, one of the underrated airlines in the world) and then book the Iran leg independently, maybe even on arrival.
Behold the incredible places where we'll build cities in space
I don't think random strangers on the Internet conducting unauthorized testing are really making much of a difference either way, so the prospect of changing how much of that goes on doesn't really factor in for me.
yes. weev would run botnets, send spam for money, break into computers, and once or twice egged people to their deaths. fortunately for him, the friends of his that would remember this (generally) don't live long, so he gets to re-invent himself every few years. I guess this time he's the savior of the internet, which is darkly ironic, considering he owned about half of the people who filed for this brief at one point or another.
How does it work? Does it just pull from the tumblr API using a list of blogs? Can it spider out and find new adult tumblrs now that they are de-listed?
And, further, it creates systemic inertia.

If the NSA has to ask, via court order, for each set of records it wants, I'm a lot less worried about somebody in government using the data for personal entertainment, financial gain, or political advantage.
This is quite some incredibly confused rant. :-)

I think it is totally OK to dislike a language for pretty much any reason, but that wall of text reads a lot like “I never actually used the language, but here are some things I read on the internet which sounded plausible to hate”, which is quite disappointing, imho.
If you want to re-litigate all of English Common Law, I've got no objection, but not much to contribute.
Sounds like those people are holders of institutional memory. The bigger companies get, the more they forget about the value of institutional memory - treating everybody like a cog in a wheel. Individual managers know the value of such people, but company policy doesn't recognize them because they aren't beans that can be easily counted.
Serving up disaster porn with Manta
You violate the rights which the GPL licence grants them, which is the rights to the source code of the actual binary they recieve, so that they can examine, modify and run their own versions of the actual binary.

In practice this works out well for developers who release their code under the GPL and want to enjoy any enhancements made to their code in return.

They will as 'end users' of any distributed modifications have the right to the source code of those modifications.

This way those modifications/enhancements aren't locked away from the original developer in a proprietary project.
Interesting to slave redis across datacenters. I wonder how well that works in practice.
There is not in fact an arms race going on between unauthorized white hat hackers and criminals.
Has anyone found any of his paintings in native resolution? I'd agree if you said that was a requirement to fully appreciate pixel art.
Personalise website content & experience based on credit history
Ekspedisi ke Balikpapan - 021 66280 28
We should have several tiers; I'm fine with essentially unlimited spying on foreign governments and intelligence agents, terrorist groups, etc. Some spying on foreign companies in defense or infrastructure, and stuff like OSINT on foreign companies/organizations/people in general.

The bar for spying on purely private foreign citizens should be high, but not quite as high as on US persons -- maybe going 3 hops at a basic level internationally (i.e. Bin Laden's courier's maid) vs. 2 hops for US persons (McVeigh's maid, but not his maid's mom).

The bar for spying domestically should be very high, and essentially limited to counterintelligence on USG employees and contractors, agents of foreign powers, and maybe certain classes of domestic terrorist; everything else should be handled under regular law enforcement.
This seems to only explain a single faulty recharge, due to the customer using the service with a zero balance and triggering the charge attempt. Why would there be multiple recharge attempts? Was the customer using the service in that period multiple times triggering each of the recharge attempts or was it the code re-trying the transaction? If it was the code why would it restart the transaction from the top instead of just the part that failed - the balance update?
The brief leaves me with the impression that

curl http://example.com/page[1-100].html (sequential download)

where no URL is password protected (open access)

is still a violation of the CFAA if someone can convince a court that such access was "unauthorized".

That's crazy.

And the prosecutor would probably proceed to call the above command "software". As in "the defendant wrote software..." Makes for a compelling narrative doesn't it? But the truth is, Daniel Stenberg wrote the software and included this feature for a reason. Was that reason to assist users with criminal intent? C'mon.

I can't help but think of all the many sources of exposed email addresses on the internet, whether they are exposed through ambivalence toward users' privacy or simply incompetence (as with AT&T).

Such sources are constantly mined by email marketers. WHOIS data comes to mind. Correct me if I'm wrong, but the information this defendant accessed was nothing more than email addresses. Is that right?

How many businesses on the web fail to adequately protect their customers' email addresses? Many more than just AT&T. And how many businesses sell their customers' email addresses to email marketers? Doesn't AT&T require customers to opt out lest their email address and other personal info be shared with AT&T "marketing partners". I don't know but I wouldn't be surprised.

I have no opinion on the guilt or innocence of this defendant. Maybe he deserves to be prosecuted.

But anyone with half a brain should be disturbed that a CFAA prosecution can proceed on a set of facts such as these. AT&T had to literally create "damage", by racking up a $7000 postage bill. Did the defendant "cause" money to be spent on postage? No, that expense was caused by AT&T's carelessnes in exposing email addresses and their subsequent decision to notify customers of their mistake by postal mail. Whatever happened to mitigation of damages?

I guess there's probably much I don't understand about this case. But reading the brief, the interpretation of the statute sounds incredibly one-sided. With this sort of loose interpretation, how can anyone defend himself against a CFAA prosecution?

If a party wants to claim some access to their computer was "unauthorized", then maybe they need to set up a proper mechanism for authorization. Usually, that's a password. The URL's this defendant accessed, where he found email addresses, were not password protected. Putting confidential information at URL's that you don't think anyone will guess does not seem to me to be a proper system for authorization. Claiming that anyone who stumbles on these URL's is making "unauthorized" access seems a like a weak argument. Apparently it'll do just fine.
The principled/safe way to withhold your taxes is to just not generate much income.
That made me viscerally sick.
Thank you for the write up here.

I was going to post something similar, but instead use the example of a lawyer wanting to perform name searches on the list of people the NSA has information on.

One point I do want to make, though, for anyone that can't tell the last paragraph might be a bit of a joke: while a Bloom filter never has false negatives, it will always have a certain amount (controllable by adjusting the size of the filter) of false POSITIVES.

Think of it this way: a Bloom filter lets you determine with 100% accuracy if someone is a member of Group A (the set you build the filter with) but less than 100% accuracy if they're instead only a member of Group Not-A.

In the example above, if Group A is the Evil Terrorists (which you build the Bloom filter with), then there's a non-zero chance that a Good American member of Group Not-A may end up falsely identified as a terrorist.

If Group A is instead made up of every Good American, you flip the problem and now have the non-zero possibility of falsely identifying a Evil Terrorist (from group Not-A) as a benign Good American.

If you attempt to use them to solve a problem like this, you have to have a mechanism in place to deal with the very real case of a false positive (or decide which group to build the filter with - which one is less damaging to have show up as a false positive).

Bloom filters are cool, but they're a tradeoff of speed and memory for accuracy. They are not a perfect index if you're trying to determine A vs. Not-A-ness. The best concept is a cache lookup - if it's not a member of the Bloom filter, you DEINITELY don't have it cached, but if there's a hit then you very very very likely have it cached (and if you don't, then at least you're only redirecting a vanishingly small number of false positives back to the live server).

Google actually uses this for determining attack sites in Chrome without giving out an index of all the attack sites they know of. They give out a Bloom filter instead with the web client. When you visit a site, if it's a miss on the Bloom filter, it is currently not known by Google to be an attack site. However, if you get a hit, it first calls home to a Google server to re-verify that the site is not a false positive and confirm it is indeed an attack site. In this way, since the vast majority of the web is not malicious, they only impose a bandwidth cost when they think you may have stumbled upon a bad site (member of the Bloom filter) - but they get a chance to weed out the false positives before telling you.
> 2:42 AM PDT / 7:42 UTC: Our on-call engineers restarted the redis-master to address the high load.

Over the years I've learned that restarting something that's under high load is not the correct solution to the problem.

By restarting the thing under load, you will always further increase the load when the thing you've restarted is coming back. Recovery will take longer and stuff could fail even more badly.

Of course there's the slim possibility that the thing under load has actually crashed or entered some infinite loop, but over the years I've learned that it's far more likely to be my fault than their fault; the abnormal load is far more likely caused by a problem at my end than a bug in the software that's misbehaving.

I know that just restarting is tempting, but I've seen so many times that spending the extra effort to analyze the root case usually is worth it.
Heh, actually it might be possible to cheat a little with this backend as well, using http://www.jsil.org/ to translate the output of the cli backend into javascript. Trying C+Emscripten versus CIL+JSIL would be a very interesting comparison.
I agree that it shows awesome mastery of paint, but the 97 year gentleman is making his own art - he just uses paint to do it.
Photoshop CC supports dynamic rounded corners.
I read the article you linked and nowhere does it say that things will break. I know it's convenient for you to attack the FSF but the real problem is that RibbonSoft is a proprietary company that is more interested in dual licensing and refuses to accept the GPLv3.
Snowden's Moscow Lawyer: NSA Leaker Is Planning To Live In Russia And Get A Job
If users don't want to run binaries for which source isn't available, they are under no obligation to do so, and can simg choose to use binaries for which source is provided; no so-called ethical "right" to source code access is violated, as the source once released remains open source.
I could have explained this better. Many usage events on the Twilio API generate a billing transaction (e.g. call, SMS message, phone number purchase, etc). When the transaction attempted to apply against a balance of zero and the customer had auto-recharge enabled, the billing system would trigger a charge attempt. With balances set to zero and read-only, each subsequent usage event would trigger a charge attempt, resulting in the erroneous charges.
Sintomas embarazo primera semana
Users -- those who are actually interacting with a running version of the software -- lose nothing with the GPL. On the contrary, their rights to the code are secured.

Developers -- those who modify and redistribute the software, in binary form or otherwise -- do indeed have restrictions designed to protect the rights of users.

So yes, the GPL does impose restrictions in specific cases to secure rights in the general case.
> Think of it this way: a Bloom filter lets you determine with 100% accuracy if someone is a member of Group A (the set you build the filter with) but less than 100% accuracy if they're instead only a member of Group Not-A.

... narrowing the scope to the lookup itself. Obviously, for actual people and actual groups things are messier (assuming a 100% chance the terrorist gave you one of their known aliases seems inappropriate).
It is indeed. Proper procedure would be to pivot to a slave. We have reconfigured all our Redis hosts to prohibit a restart on masters to prevent exactly that temptation.
> ".. Twilio usage that resulted in a billing transaction (e.g. 1 cent for a SMS message or a phone call) triggered the billing system to attempt a recharge using the credit card associated with the customer’s account. This only affected accounts with auto-recharge enabled."

> "Consequently, the billing system charged customer credit cards to increase account balances without being able to update the balances themselves. This root cause produced the billing incident of customer credit cards being charged repeatedly."

Sounds like when an action required funds from a user's balance (which their system thought was 0), it attempted to recharge their balance by charging their credit card. And since the system also could not write to the database (to increase the balance) the balance remained at 0. Thus, the system kept thinking it had to recharge the balance again.
> I also have to wonder where high-school students who drop thousands of dollars into their hobbies are getting their money from. Parents?

I often wondered the same thing, given that neither I nor my parents had anywhere near that much money to fritter away.

I think it comes down to parents directly or indirectly though. You can make a fair amount of money with a summer job and part-time job the rest of the year, when you don't have to pay for rent, food, etc.

It becomes harder to maintain a hobby once you have to move out and live on your own.
I would assume from the article (I have no experience with Twilio) that there's some "purchase X more SMSes when I've fewer than Y SMSes left" feature. So whenever the customer uses their API to send an SMS (or make a call), the software would detect that there are fewer than a configured amount of messages left and would bill the customer to top off the account.

The actual billing would go through ok and the master database would likely get updated, but the frontend that's doing the sending won't see the updated balance, causing it to purchase more credit.
Where do you see that the pre-orders come with SD cards? The order page at

http://shop.adapteva.com/collections/parallella/products/par...

says:

"Unless otherwise specified, the Parallella-16 board ships bare without a 5V power supply or SD card. (These must be purchased separately.)"
might be a honeypot for leakers?
>The GPL is really about enforcing your ideals onto other people's code if it happens to be reliant on yours.

Oh please, enough with the bs, your code won't just 'happen' to be relient on GPL licenced code. It's just as much of a choice as that of end users choosing not to use proprietary code which you keep repeating.

And of course it has to do with user rights, that is what GPL preserves.

The right to the source code of a binary containing GPL licenced code, the right to modify and build binaries from that said source code.

It legally binds anyone who uses GPL licenced code to grant those _rights_ to their end users.

Being able to examine the code for the ACTUAL binary you recieve, rather than some original source code which may very well have gone through numerous changes before being compiled into the ACTUAL binary you recieve are very different things.

And I've already described how from a developer standpoint this is of importance as they are likely interested in recieving enhancements to their code in 'source code form' if they choose to licence under GPL, but it's also of importance in other aspects aswell since you as an end user may want to examine the source code to make sure it doesn't do something you don't want, or change it's behaviour to do something _you_ do want.

Those are definitely 'user' rights.
We encourage real-name usage to make Community feel more like a family.

Because that worked out so well for G+.

As for W.A., I keep trying to get it to tell me how much ice covers Antarctica, and it keeps giving me weather reports. No threat of the singularity showing up in WA-ville anytime soon.
Good for them for being open about this. Solid incident reports like this make me trust a vendor so much more. Not only do I have a good idea how they will handle a big public failure next time, but it tells me a lot about how they're handling the private issues, and therefore how robust their system is likely to be.

One minor suggestion: the root cause of an incident is never a technical problem. The technology is made by people, so you should always come back to the human systems that make a company go. Not so you can blame people. It's just the opposite: you want to find better ways to support people in the future.
They might have hundreds of years ago. But nowadays they won't (though if I refuse to file taxes things may be different).
Yeah. I totally agree with your conclusions in your article. I was making a general remark because this doesn't just apply to you guys but to everyone else too :-)

Btw: When going to a slave, be careful because the state the slave is in might be out of date compared to overloaded master at the point of moving over.
Do you not see how ridiculous you sound? Working around licensing by building a hackisb fork-based plugin system?

We're in this business to write software for people to actually use.
I've been looking forward to reading this. It never fails to amaze me how these sort of incidents are caused by a cascade of small, unrelated problems, any one of which on its own would likely not have caused the end problem.

The post-mortem has plenty of details but without being wishy washy in any way. Just the fact's ma'am, ending with a sincere apology and steps to prevent a recurrence. Well done!
I don't use Twilio, but this was an interesting write-up. After reading it, I can totally understand how important it is to have safe-guards and redundancies baked into user balance information. I like how they even mentioned (although a bit vaguely) how they plan to implement those additional protections [1].

[1] "We are now introducing robust fail-safes, so that if billing balances don’t exist or cannot be written, the system will not suspend accounts or charge credit cards. Finally, we will be updating the billing system to validate against our double-bookkeeping databases in real-time."
1. Founder bandwidth

2. Sales

3. Founder bandwidth
Agree completely.

Ultimately the responsibility for getting this right is on us. We feel a thorough, dispassionate accounting of the human and technical errors when we come up short is part of living up to that responsibility.
It may be mental baggage from my previous career in submarines (where "symbol speaking" was highly frowned about), but I simply say it out: Not Safe For Work, instead of En-Ess-Eff-Doubleyou. In that context it would be (for me) A NSFW ..., but it seems the right answer is in the eye of the beholder. :)
>Don't get me wrong, great strategy that works and anyone who runs a business should continue to follow it lest they want to be ousted for cause, but sad reality that it's the state of things.

Huh?
This is a great story. These are also the type of stories that should be shared to build bridges between different cultures and communities. The elderly are our nation's treasure.
It sounds like the key benefit is intrinsically problematic... How could they build the platform the right way?
Yes, I agree, it is ridiculous. That's what happens when you have to deal with software licensing. The whole point of licenses is to be incompatible, if all licenses were compatible then we would only have one license.

I didn't come up with this system, if you must blame something, blame copyright. If you think it's bad this way, it's even worse when the two licenses in question are proprietary; often times in that situation you won't even have the option of a rewrite or a workaround. The nature of copyright is that not even free software licenses can give you the legal ability to do everything you could possibly think of doing, but they give you enough to ensure that every user is granted the four freedoms as long as the copyright holds. The FSF's position is that it would be more meaningful for the community to convince RibbonSoft to re-license as GPLv3 than it would be to have the short term gain of having DWG support available sooner.
> You can run a grocery store where everyone puts the money they owe into the cash register before they leave there are no checks on the cash register, everyone is trusted to do the right thing. The store going out of business isn't a "problem" it is the expected outcome.

Kind of not the main point here, but I've been in a store that was left unattended and there was a basket of money out for people to make their own change. As far as I know it's still there...
Very true - in this business, it nearly always is a waterfall of small errors that produces large consequences.

Part of why I love being a software person - the devil lies literally in the details.
Kisume.js: reliable `window` access for userscripting
Indeed, I wondered if the dark humor of the last comment might be a little too subtle. :)

One of the bummers about this scheme is that it doesn't have the property of making the bandwidth for all queries constant (get the bloom filter) instead of linear in the number of lookups that the regular non-private use of bloom filters has. But thats the tradeoff for the bi-directional privacy.

I could actually imagine a production system using this, which is something I can't say for most privacy preserving query techniques.
In the same way that a normal roof heats up the environment, yes.
Truthfully the billing system is one of the most fascinating parts of our stack to me. Twilio's utility pricing model generates an incredible volume of minute transactions, which is a fascinating engineering problem to solve at scale.

That solution ultimately came up short last week, but think the foresight behind a number of the features (double bookkeeping to an unrelated, persistent datastore in particular) aided in recovery.
So, the users most affected were some of your most active/high traffic ones? Ouch.
Opinion: Used games are fair trade