skysight-inc/HackerNews huggingface dataset:
It's not very useful to compare bug bounty payouts to what the "black market" would pay for a vulnerability.

Let's look through the challenges of selling a vulnerability that allows for arbitrary account takeover (much more serious than this):

0. Find the vulnerability. Assume that no one will find it by the time you find a third party buyer.

1. Look for a buyer. If you're not well-connected, you might stumble into an FBI honeypot (a sting operation) because you don't know what you're doing. But let's assume you know what you're doing and you find a buyer.

2. You negotiate a price. You don't receive much more than Facebook would pay you (if they even give you that much) for a few reasons:

a. The vulnerability can only be used on Facebook, so it's not vendor agnostic (compare Heartbleed, Shellshock);

b. The vulnerability has an extremely small window of capitalization - it will be discovered within a week of use, maybe less. The Facebook incident response team is spectacular.

c. You need to figure out a sufficient monetization strategy for distributing malware or spam using profiles that are taken over using this vulnerability. You have a week of use, much less if you try to take over accounts too aggressively. Now you're going up against all of Facebook's other protections - once you have the account, spreading malware will either be algorithmically discovered by Facebook or reported by other users.

With an organized crime unit composed of professional hackers, this might pay off. Maybe. And that is for one of the most serious bugs you can find. You're better off just taking what Facebook (generously) gives you.

The classical fallacy people fall into is believing that a web application vulnerability is worth much, especially the variety most tech companies have to offer. It's certainly serious, yes, but it's only worth what a market will pay for it. It's worth a lot to Facebook for brand integrity. It's not worth a lot to hackers looking to make money.

The only web applications that might be worth real money would be banks or government institutions (or similar platforms). Real money is found in vulnerabilities on desktop clients, especially memory corruption vulnerabilities, or in ubiquitous software that affects servers. You want to be able to compromise a user for use in a botnet or distribute malware to steal their money or personal information. Alternatively, you want to be able to attack, say, 30% of the websites on the internet with a wide variety of options after you get in.

Examples include:

• Vulnerabilities in Flash.

• Vulnerabilities in Python, Ruby or corresponding web frameworks.

• Code execution in iOS that allows a jailbreak (most sources indicate the going price for this is $500,000). Other vulnerabilities as well, such as compromising app store receipts or in-app purchase checks.

• Vulnerabilities in Android, up to and including code execution.

• A game over flaw in any number of ubiquitous software packages used on Linux servers with root access.

• A sandbox escape in OS X or Windows (you'll be paid more for Windows but both are lucrative).
>As far as I can tell it's nothing more than a similar type of bullying

It absolutely is. "MRA" is a short cut to dismiss an entire spectrum of arguments and perspectives. Just as farcical, but on the opposite side, are people who declare anyone who has a problem with something like, say, "GamerGate", a "SJW".

These are shorthand for idiots. It lets you pretend that you're in a tribe and everything is black and white.
$2.25 Lyft Line Rides. That’s Right
Some of the "old Lisp things" are becoming new again.

For example, John Shutt has developed a non-trivial theory of F-Expressions (vau-calculus)[1] and a language named Kernel that employs them[2]. Neither has received wide attention yet, but the Lisp renaissance of the past few years is still young...

[1] https://www.wpi.edu/Pubs/ETD/Available/etd-090110-124904/unr...

[2] ftp://ftp.cs.wpi.edu/pub/techreports/pdf/05-07.pdf
Now would be a really good time to make sure there are copies of those elsewhere. MIT is not wealthy like Harvard sort of is (long story), and in all cases one needs to remember that the vast majority of endowment money is earmarked (somehow donors trust college administrators only so much, and then there's Princeton).

OCW is now in maintenance mode as far as I can tell, with terrible gaps in offerings, like 2nd term bio- and organic chemistry but no 1st term offering, and given the astounding breath of the demand, there's every chance a very large fraction of MIT's video and audio offerings will simply go dark, and future production burdened by red tape (which MIT students do not respond to well...).

Especially since the lawsuit demands quality captioning. Granted, there examples on their web page are awful, then again they're nothingburgers: http://nad.org/news/2015/2/nad-sues-harvard-and-mit-discrimi... at least if my understanding of the lack of real power of the President of Liberia is correct, and it says something that they put Lady Gaga being welcomed by Harvard students right after it. If this is the best they can come up with....

Not that I know any SJW deaf types right now, but if I did, they'd be treated to the one of the very few bits of sign language I know :-(.

Disclaimer, I'm MIT Class of '83, donate to OCW, and am beyond annoyed.
Great summary :)
Not true because of people like you who force the link, who call,email and tweet employers about the behaviour of their off duty staff.
"When men are friends they have no need of justice"

Aristotle
I'll go edit the post to make it more clear that you need to follow the links through the code to get the actual answer... it's more involved than a single snippet.
I don't understand what one of the hints means: "One specific dot is included in all solutions imaginable."
Indeed. I'm pretty sure there's no book treatment of Lady Gaga being greeted by Harvard students.

(I swear I am not making this up:
http://nad.org/news/2015/2/nad-sues-harvard-and-mit-discrimi... and if those are the best examples they can come up with for a national campaign....)

Disclaimer, I'm MIT Class of '83, donate to OCW, and am beyond annoyed.
For anyone interested in this issue, I recommend the two reports from Citi and UBS described in these articles:

http://reneweconomy.com.au/2014/citigroup-solar-battery-stor...

http://reneweconomy.com.au/2014/ubs-time-to-join-the-solar-e...

It all really comes down to battery cost. If Tesla's gigafactory does what it says it will do, in seriously reducing cost per kwh, then a huge home storage market will open up naturally.

The projections do seem a bit heroic, though. People seem to have been predicting cost reductions in batteries for the last 15 years, but they don't seem to have come to fruition.
I also said: No one deserves to be bullied or harassed but consequences need to exist to actions.

I meant the outcome from a professional standpoint was fair. I don't believe how her life has been "ruined" as I've explained elsewhere.
We added Show HN to the title since this is a good match for it.
> Edit: don't forget that AC is much more efficient than heating. With AC you are looking to change the temperature by at most 35 degrees and you are moving heat, so you are getting a multiplier there. With heating, you are heating from freezing or below for most places.

Its also incredibly efficient if you're using a geothermal system to pull cold out of the ground vs pushing heat into existing hot air with a compressor.
I was about to make the same comment.

I'll take a wild stab at why setting/getting `b` is slower. The author of the code has just inserted another call layer by manually defining the getter and setter in Ruby.
ZERO WASTE Grocery Store
The proportional response to offensive speech is a rebuttal.

It is not stripping away the other's anonymity. It is not convincing their employer to fire them. It is not ostracizing them and all their immediate associates from civil society.

If someone tells a horribly offensive joke, there are several acceptable responses. One is "We are not amused." Another is "The Aristocrats!" Grabbing torch and pitchfork, and marching to the castle to demand that the monster be let go--and without even a letter of recommendation--is not.

Think before you act, yes. Think before you speak? That seems a rather lofty expectation, even in 2015. There is no ill-considered thought so swift that it cannot be hunted down with a remorseful apology.
Coming March 2015: Revolutionizing the way you find your friends
I interviewed at a travel company last year. It was interesting because they didn't do any of the backend booking stuff (for flights), but instead seemed to like to direct you to other sites to book and then take a referal cut if you buy. This was a weird business where the person buying the travel was the product (I didn't like it).

Expedia is one of the direct bookers. I use them. The UI is not pretty but functional enough.
I think it has something to do with two adjacent "known" dots (for example, I got that on both a 6 and an 8 when both were right next to each other).
50 Austin startups to watch in 2015
Dude ... you did something that sent you to prison so, by definition, your rights are going to be curtailed.

I do however have a problem with many of the things we send people to prison for ... let's fix that first (and those who therefore don't go to jail won't be in trouble for their social media habits).
Sneakers - one of the best computer movies when I was a kid. I used to watch it over and over again. Good times. Must go find it somewhere. That movie probably had an impact on actually getting into the business later on.
This isn't "hacking" anything.

For content marketing, you need to have actual content.
When I was younger and much more stupid, I told a joke once that in hindsight was homophobic. I in no way every considered myself homophobic whatsoever and it was just pure stupidity and thoughtlessness on my part. I was at a party and my joke went over like a lead balloon and I was immediately embarrassed. I believe I deserved to be embarrassed and that thought me a lesson. I feel like that, or perhaps a stern lecture is an appropriate reaction to somebody telling a thoughtless, tasteless joke.

At some point in life we all realize that we're not as funny as Steven Colbert, we're not as good looking as Brad Pitt, etc, etc. When you come to that realization, learn your limits and don't try to pull off a racist joke or wear a speedo to the beach. It's unfortunate that she had to learn this lesson in such a painful and public way. She was clearly in the wrong, but I don't agree that mob justice fits the crime.
Fingerprints are still a better authenticator than a 4 digit passcode in practice. Nothing is infallible, it just needs to be good enough. Biometric security things can be very good at preventing 99% of the problems with 1% of the effort.
Took me a bit to understand it too, it means: Of all the possible permutations that the surrounding dots (of that dot) could be, there is at least one dot that is the same (so that while you can't 'solve' that dot, you can still start to fill out the surrounding).
Oops, that's a bug -- it's supposed to prompt you once, just to give you the option to save the setting. I'm pushing a fix now.

Sorry about that!
I think the grandparent is making a point about perspective and POV, one that you have conveniently proved by responding with an argument in absolute terms.

To some people, Planned Parenthood aborts fetuses. To other people, Planned Parenthood murders babies. I personally am much more in the former camp than the latter. But would you want the people who believe the latter to get you fired from your job because they read your Hacker News comment and plaster it all over conservative newspapers that "wavefunction is an apologist for baby murderers!"? I certainly wouldn't.

The nuance that always gets lost in these discussions is that different people have different points of view, and the same words may mean different things to them. Combine that with the lynch mob mentality and you have a powder keg.
Gravity is too weak. Flywheels are the way to store kinetic/mechanical energy, but the up front cost is pretty steep.
A bit off-topic but following similarity is noteworthy:

From this article:

>>> They were both to be “whipped at the public whipping post 20 stripes each.”

This was year 1742.

From the web (http://www.news.com.au/world/middle-east/raif-badawi-to-be-p...)

>>>HE IS brought before the crowd and whipped relentlessly 50 times with a long, hard cane.

This is year 2015.

But you can notice the similarity in punishments.

We need to understand that society in every country evolves over time at its own pace. This evolution can take centuries of time in some cases because societies has to understand and readjust peacefully as much as they can.

I guess American political leadership needs to understand and remember these parts of their history before pointing out and shaming/preaching other countries on human rights,intolerance...etc.
Perhaps it depends on how much content you're putting into the message, normally? Eg, big multi-line strings, followed by more args at the end, is not a syntax i personally prefer.

With that said, i really do wish Go supported `DebugWithTags(tags ...string, message string)` syntax. I've had so many cases where i wanted to use something similar.
Also related:
http://mesosphere.com/2015/02/11/yarn-on-mesos-big-data/
But unless the signers have a public certificate, or publish their public keys on their website (which you need to obtain manually), the signatures on Maven Central can be just as fake as the artifacts.
What the hell is Slack?
I agree with you 95%. The 5% being an admittedly far fetched and idyllic notion that just maybe one day we will design the mythical x86 bacterium and all of a sudden instead of needing meticulously crafted silicone wafers and logic gates... all of a sudden all we need is cheap simple hydrocarbon to grow the world's most elaborate super computers. They wouldn't be faster but more efficient and highly parallel. Like a more distributed version of a brain where bacterial (or whatever) cells take the place of traditional neurons.
It also mentions that at the end of the linked article. This is an adapted excerpt from the book (unsurprisingly).
The game is weirdly dystopian for something made from circles and two colors.
As a naive layman, I'd be very curious to see numbers on inefficiencies of non-tracking panels vs. typical transmission loss.
My introduction to the central limit theorem was that chained independent random processes tend to result in a Gaussian distribution. This is so general that one is surprised when one finds non-Gaussian distributions (canonical example: the stock market).

I attended a lecture by Mandelbrot (shortly before he died) where he spoke at length about this- take a look at stable distributions and the generalized central limit theorem.
That makes sense; I had no contact with the posix world back then.
PCI DSS and PA-DSS v3.0 drops SSL in favor of TLS
Live Patching Now Available for Linux
Related: https://news.ycombinator.com/item?id=9039197
For coal, I think it is because of the large turbines used. They have to be brought up to temperature gradually because they are very large precision made hunks of metal.
"Based on my (admittedly very limited) experience with French culture, this is definitely the most important difference."

Unless they are saying something conceivably pro-Nazi?
I have 48v in both my home rack, and the offices rack.
http://www.ntp.org/ntpfaq/NTP-s-algo.htm#Q-ALGO-CLK-UPD
The lack of security surrounding Chip and PIN doesn't surprise me. A friend of mine is dyslexic, and one of the symptoms is that she has a real hard time remembering arbitrary sequences of numbers, like PINs tend to be. As such, she's one of the few people on chip and sign, and has no PIN attached to her card. Even with that, she /still/ has to deal with fraud departments every few years saying that someone used her card and "PIN" in some obscure location, and this is obviously all her fault. It takes quite a bit of frustration for her before the fraud department finally comprehends that there is no pin to clone there.

Of course, me being stateside, I still have to deal with antiquated magstrips and /their/ various faults. I've got cards with chips in them, but no one is taking them yet, and the bank I'm with (Wells Fargo) isn't even planning on rolling out chips on their debit card line until the end of the year, and even then, by request only. The whole financial security system is just ridiculous.
great quote from a great movie. It's bizarre how much animal behavior we have in us when you look closely.
I would be in favor of Facebook relaxing it's policy regarding password-sharing for inmates, who can't legally access Facebook directly. Like the article says, Facebook could be a great tool for sharing information about social injustice inside prisons.

Prison policy here sounds like a flagrant violation of the first amendment, when you think about what social media actually is. It's just a way for people to send messages to each-other. Punishing an inmate for asking his friend to post on Facebook on his behalf is equivalent to punishing an inmate for asking his friend to send a letter on his behalf.
Totally agree with you; however, I think it showcases that maybe Javascript is now Python's biggest competitor. It is more on the productivity and expressiveness level of Python but now works in a greater number of places than Python. Sure it is not as elegant, but it is improving a lot faster than before.
1) when I read the offending tweet at the beginning of the article my first thought was "she's making fun of clueless white/rich people traveling abroad." (If you've traveled you may have bumped into this not-uncommon type.) so I think it's reasonable to believe that explanation.

2) I got the impression that this was a personal account, meaning I'd judge it based on what stupid shit I hear people say in bars or other social/personal situations. I know plenty of people who have said way worse things, and continue to.
Based on the breath of the demands per http://nad.org/news/2015/2/nad-sues-harvard-and-mit-discrimi... it sounds like just about anything that's vaguely formal, way beyond instructional video and audio. And since they highlight quality problems, albeit bad ones but of mostly silly/very limited utility content....

Nothing good will come of this.

Disclaimer, I'm MIT Class of '83, donate to OCW, and am beyond annoyed.
Live patching the Linux kernel
I don't live alone, and I live in a place where the weather occasionally dips to -30F wind chill (and in summer occasionally hits 90F), so I understand hot and cold weather. I have a family and pets.

Literally every single person who commented on this has completely and 100% failed to read a single word I wrote. You're wrong, you're missing the point, and it seems like you're intentionally being obtuse.

Sorry if this sounds snappy, but I've read and re-read my original post over and over again and I'm not seeing why everyone interprets it as me telling them AC and heat isn't necessary. Things like "It would be nice to re-think the necessity of AC, as well" and "There has to be a way to cool me down in the summer without needing to cool my entire house" don't mean "turn off your climate control", they mean "let's get better climate control".

Your comment is exactly the kind of thinking that I was arguing against. Right now we need AC and heat for the entire house. Just a few years ago, we needed gasoline to power our cars and just a few decades ago we needed a dedicated room to run a calculator.

I have a coat with a battery that heats up just the coat for when I'm outside in winter. Shrink it to a normal long sleeve shirt that you would wear inside anyway. That's a start. The point is, we need heat/AC now, but are they the best we could possibly do? And is forced air the best we can do?
It's not a technical issue. The fact that field "x" in a record changed from 4 to 5 (even if you can know every value that has ever been in that field) will never be able to tell you why that value changed.

Was it because a CSR got a call from a pissed-of-customer and agreed to change it? Was it because a third-party system fucked up and decided give the customer a little more "x"?

This is where Domain-Driven-Design comes in and CQRS/Event Sourcing really shines. The net effect of those two events I just described may be exactly the same for MY domain, but if there are other systems that are listening for the domain's events they may come to radically different conclusions. In CQRS/ES you would actually record those two things as different events, semantically.

It really upsets me that people don't get this about CQRS/ES. Maybe I should just start spamming links to Greg Young's talks...
Why and When Could We See an Apple Electric Car?
Koding- Cloud VM for development
There's a spectrum of near vs. far from the machine, but there's no spectrum of computability, all Turing complete languages are equally Turing complete. There's no difference between Lisp and assembly in this regard. In fact if you take into account the big-O time complexity, then assembly is better than the version of Lisp described in the OP, because the latter suffers a logarithmic penalty due to immutability.

More to the point, Lisp is nice because it's in a sweet spot of language complexity vs self-interpreter complexity, and lambda calculus is nice because it's a simple basis of computation. But there are many languages that make self-interpreters simple (assembly, Forth...) and many simple bases of computation (SKI calculus, rule 110...)

To call something the "Maxwell equations of software", IMO you need something more substantial. For example, Haskell folks can claim that lazy evaluation is provably superior (in termination and time complexity) to any other evaluation strategy. The dependent typing folks can claim that all valid programs correspond to valid proofs and vice versa, and that strict and lazy evaluation are equivalent w.r.t. termination. The guy behind Kernel can claim that the one true Lisp should allow you to mapcar a macro. There are many kinds of wonderful math that give you insight into computation!
You addressed 1 of the 2 major issues I have with the ACA. I think the issue you raised could simply be called transparency, but as you allude there is no reason when I click on a plan in any market place, that I should not be able to see an exhaustive list of the providers who accept the given plan and a list of providers who do not, aside from premiums I would imagine this is the single most important factor to the majority of consumers, and the most important for people who are not picking plans based on finances. There are other data points insurers should be made to disclose as well, such as: the total number of claims under a given plan, the number of claims that were paid/not paid out, and the average amount of time it took to approve/pay said claims.

The 2nd issue, none of these plans on the market place make healthcare affordable to those who were previously uninsured due to cost. Yes, there are subsidies for premiums, but once someone actually has to use the plan, most can not afford the out of pocket co-pay much less the deductible. Due to inability to truly afford their subsidized insurance plan, people avoid using their insurance and so all the mandate really seems to do is line the pockets of the insurers with subsidized premiums on behalf of people who knowingly will not use their plans.
In Spanish, these are 'voltio' and 'rayo'. The words you mention are not Spanish words.

However, it is true than in Latin American Spanish we do not perceive the difference between V and B. I guess the Aztecs and Incas did not have that in their own languages.

In Spain they do.

And in portuguese (the most similar language to Spanish) the difference is important as well.