EnFinlay

I fundamentally and vehemently disagree with you.

Definitely a pet peeve that so many software developers call themselves software engineers. I went to engineering school in Canada, and no longer wear my ring because the work I do is not engineering, it's development.

I'm not trying to knock the software development profession, I have a lot of respect for and derive a lot of joy from the work. There's just a difference between "As a member of this association of professionals, I declare this a safe and appropriate design, and am personally and professionally liable for failures in this design" and "I have push access to master and can deploy code to prod".

Not too long ago I would have whole-heartedly agreed with you, but I've since accepted that my opinion on her was strongly swayed by social media (specifically on Reddit) campaigns lead by Russian entities.

How much do the e-mails matter? I don't know, it's hard for there to be an objective answer since these things matter as much as everyone talks about them. Everyone talked about the e-mails, but did that conversation cross the threshold from factoid to scandal due to malicious acts by Russia?

Do the e-mails matter less than things happening in the Trump campaign at the time? It certainly seems that way, especially since there have been stories about Trump administration private e-mail servers that have barely made it into the news cycle (that's from memory, apologies if I'm not remembering that properly).

Everything there might be true. Everything might also be false. It might be cheaper to start a business because PPI information will be handled properly from the start and not be a cost centre. This might increase new business viability.

Maybe there are no "costs". Just benefits and benefits?

Most people don't die from food safety violations, they just have a really bad day. I would say this is equivalent to the harm done by something like the Equifax breach.

I didn't write the parent comment, but I don't think what they're trying to do is

> finding a reason to regard this study as irrelevant to one's specific circumstances

It's more about being precise about what exactly the study found. There's a real problem with legitimate studies being reported as something sensational, and then when the headline is proven to be false the public loses respect for the scientific process.

Ah gotcha. Thank you for the explanation!

> but there are still some people in the world who like to know what's actually going on instead of believing what they're told to believe.

I'm confused, is that the people who listen to what is routinely reported in the newspaper, or other people?

Interesting. Have you see "The Big Short"? Towards the end there's some scenes where banks aren't paying out on Credit Default Swaps (I think) even though the mortgages were failing. The movie didn't really touch on why this was happening. Was this caused by the second manipulation that you mentioned?

True, it sounds like profiting from rising house prices is icing on the cake.

The article makes no assertion about the demographics of Fentanyl dealing or trafficking, just that these Chinese lenders are involved with these activities.

Are you saying that the opioid crisis can be fully blamed on Chinese foreigners? Is that really what this article is saying? Or is that your intuition.

It definitely gives me the feeling that the popular solution will be something xenophobic. Maybe there's hope for less knee-jerk reactions, like some regulations where when you lend money, the source of that money must be properly tracked. That way when someone claims a mortgage or lien on a house, it won't be respected unless the money lent was confirmed to be legit.

The article makes it sound like an amazing cycle of selling drugs, money laundering, loan sharking, and profiting from the real estate rise.

That behaviour describes my biggest pet peeve with banks. I don't want product offers from you. You take my money, make money with it, and pay me interest (a whole < 1%). That's our relationship, fuck off with your "credit card protection free trial period".

I too wish you the best, sorry for coming across so aggressively.

No, I didn't find it offensive. And characterizing a suicide by someone who broke multiple laws, got rich doing so, and then being unwilling to face the laws as "tragic" is a bit disingenuous.

I'm far from an expert, but my guess is that the quote

> "Windows provides multiple ways to do it," he said. But DLL hijacking isn't limited to Windows, he said -- noting that it can apply to Macs and Linux, too.

is an artifact of the reporting, and not worth head scratching about.

The exploit would look completely different on Mac or Linux. As far as I know.

My bet is that they're different people motivated by different things.

Haha, good point.

Reading your comment finally made it click to me why cryptocurrencies (specifically Bitcoin) are distinct from a gold bar or other non-currency stores of value. A gold bar is going to remain a gold bar forever, people's perception of its value will change even though the supply will remain mostly steady, but it will stay a gold bar no matter what.

Bitcoin may change in value based on perception, it's supply will remain constant after it has all been mined, but it's existence and integrity relies on a large network continuing to exist.

To put it differently, in 50 years a gold bar is a gold bar, but in 50 years a Bitcoin may have no value because everyone stopped mining and the blockchain was destroyed by 51% attacks.

In some respects this seems like a better application of blockchain than a lot of ICOs.

On the other hand, it isn't clear how they're going to solve the oracle problem of deciding who has the canonical rights to a given photograph.

But that's my point. Of course he deserved a payout if he reported a previously unknown vulnerability. What I'm saying is that he (appears to have) behaved in such toxic way (sow) that someone denied something he deserved (reap). All parties in this are squishy humans with emotions.

No one looks good - he doesn't look good for how he behaved/communicationed, Uber doesn't look good for denying the payout on a valid report, and Hackerone doesn't look good for not enforcing a minimum payout on a valid report.

It looks like a "reap what you sow" situation. No one is looking good now.

> Then they disabled completely the Uber Report Issue button

I don't have enough signal to make a report, but the button doesn't 404 for me, so my guess is you've been shadowbanned.

> then surely they could cite to the prior report or an internal ticket to that effect

Yeah, they should, at least to build the relationship. Public programs have so many erroneous report they probably stopped doing the "nice" thing ages ago.

> But the best part is, when I was reporting various issues to the Bug Bounty, their staff is actively fixing stuff on the backend - that XSS issue they were trying to fix on the backend, but without paying anything for the discovery. I was getting different application responses after the initial report, but only until I gave them more info on the WAF and XSS_Auditor evasion stuff did they finally pull the whole application offline. And then still didn't pay.

If this is true, that's really bad. I'd be curious to hear the other side of the story if there is one.

Okay, so for the first 4 bug reports, I'm on Uber's side. In their Hackerone program details it says that one of the valid close states of a report is [1]:

> duplicate -- a vulnerability that has previously been found either internally or via Hackerone

As much as it sucks to find a bunch of vulnerabilities and not get them paid out, it doesn't make sense for Uber to a) publish a list of current unpatched security vulnerabilities or b) payout everyone who reports the same vulnerability (make n accounts, report the same thing in each one, get minimum payout * n). I'd say it's off base to say that Hackerone didn't have your back. They were duplicates. No payout. Of course, this does mean taking it on faith from Uber that they WERE aware of these vulnerabilities.

For the final report...that's straight bullshit. Did you ask for mediation from HackerOne on that one? Cause if it's an XSS which triggered them to change the code, that deserves a > minimum payout.

[1] https://hackerone.com/uber

> do you really think I would put such nonsense on my own site

Well apparently you allow anyone to have access to what's shown there, so it seems you don't care what nonsense gets put on your own site.

The cloud enables easier scaling, it's not a silver bullet. No matter what, scaling plans have a region where they break down, so it doesn't imply they aren't designed for good scaling.

We all live with this scenario everyday, most consumer locks are ridiculously easy to open. https://en.wikipedia.org/wiki/Lock_bumping

I hear you. If I'm understanding you properly, you're just saying "Waymo has done some shady stuffy too" to establish that you're not a fanatical "yay Waymo boo Uber" person and are willing to see fault regardless of which side it's on.

The story is about a way that a specific company is potentially being used for money laundering. There's no calling them out. Calling them out would be "Online fraud costs $X billion a year" and then only giving examples of AirBnB.

To put it differently, the story is that this is happening to AirBnB, the fact that happens to others is not important. Not every story is about the fully zoomed out overarching issue.