sjbase

> "There’s no way people are not exploiting this in the wild"

Hard to disagree there.

Does it really usually take 2 months for something like this to get disclosed? Seems like anyone bored enough to run a SYN scan on one of these would find the vulnerable services instantly.

I think your top comment is being interpreted as "not responsible enough to use [any form of psilocybin]" - that's how I read it until I saw this comment, which makes me think you were actually referring to dosage safety and presence of toxins.

I strongly disagree with the first interpretation: I can't imagine any connection between identifying plants and having the introspection and self-criticality to know if, when and how much of a psychoactive substance to use. But I agree on the dosage/toxicity aspect. Way more stochastic than what your everyday recreational alcohol or marijuana user is probably used to.

It seems unlikely that he was brought in to take Expedia public, since he joined 6 years after their IPO.

Expedia went public in 1999 [1], when Dara Khosrowshahi was working for an Expedia competitor: IAC. He didn't join Expedia until 2005, when IAC acquired Expedia [2].

Maybe I'm missing something?

[1]: http://www.nasdaq.com/markets/ipos/company/expedia-inc-1567-...

[2]: https://en.wikipedia.org/wiki/Dara_Khosrowshahi

This would be perfect for Letters of Note, a blog I _highly_ recommend: http://www.lettersofnote.com/ (I have no affiliation with the site)

This type of headline is why large enterprises are often careful about working with unproven 3rd parties. And consequently why the enterprise sales cycle feels so slow and bureaucratic.

LockState makes the mistake, and AirBnB takes collateral damage.

This was my thought as well, and what I was referring to re: "so many observations on each username" in the parent.

The reason this seems unlikely to me is mainly rate limits and password lockouts. Plus you're adding a multiple on # of requests for each username you want to try. Say your dictionary has 10,000 usernames (very small IMO). That turns into 10,000,000 requests if you need 1,000 observations on each to control for jitter.

Not impossible to find this in the wild, I suppose, but pretty trivial to prevent at any layer.

Typical network jitter is in the range of +/- 10ms over the Internet, optimistically. So the hash computation needs to be well over 10ms to be noticeable, or you need so many observations on each username that something emerges statistically.

Both seem unlikely. Am I missing something?

I once saw the claim: for any headline ending in a question mark, the answer is always "we don't know."

I have never found a counterexample.

Is NLP almost at human-level accuracy in picking up on subtext?

Can it formulate a human-level response to sarcasm? Could it respond in kind?

Does it know when a question is rhetorical? :)

Has anyone here done a migration from S3 to Wasabi, and successfully realized the lower total cost Wasabi is claiming?

I suppose the "Here's the MD5 for your download" concept is useful if the file is being served from a different host than the website itself. Someone could tamper with the file server, but may not have access to the HTML rendering a link to that file server.

But you're right about serving the data & checksum from the same source. I don't see what extra layer of security or integrity it adds. Someone tampering with server file system, or the data transfer (MitM) inherently has the access they need to inject their own MD5 into the HTML.

Makes it much harder to raise future financing, which is bad for everyone.

A company who has given away equity with anti-dilution is much less attractive for a new investor. If 30% of the company is allocated on anti-dilution, that means everyone else without anti-dilution is fighting for the remaining 70%. ALL future dilution comes out of their share. It acts like a dilutive multiplier.

So any new investor is going to want anti-dilution also. But there's only ever 100 percent. So you end up with new investors trying to force old investors to sell (or tasking the founders/board with doing so). This is not uncommon in reality.

BTW, most anti-dilution works by allowing existing investors the option to put in more money with each new round. I.e. they can "top off" their equity to X%, but only by investing more. So as an angel, you might have invested $100k for a few points, but to stay topped off in future rounds, you start having to invest a lot more as the valuation goes up. Not everyone has the desire or liquidity to do that.

Does anyone know: what are the failure rates like for the gene editing technology being used for this? Thinking like a software engineer, are there transposition errors (GATC --> GTAC) , atomicity issues (GATC --> GA)? Mutations afterward?

Can anyone weigh in via personal experience: how much Chinese would I need to learn to avoid getting pigeonholed to tourist areas in these cities? Is Mandarin spoken pretty uniformly?

I'd love to go, and have used google translate extensively, but am concerned about not being able to read signs. I agree that travel should be challenging, but not to the degree that it kills the experience.

Jon's post notes that this is the industry standard. Anecdotal, but my experience matches that claim (last data point being end of 2016).

I've never encountered any compelling rationale as to why/how that standard emerged.

Worth pointing out that tech stocks are down heavily in June, esp. consumer tech [1]. Some portion of this decline is unrelated to investor confidence in Snapchat relative to FB etc.

[1]: http://www.cnbc.com/2017/06/09/big-five-tech-stocks-sell-off...

Super cool idea, but there's a ton of potential for misunderstanding. Example:

User: "I want {A}."

Winning developer: builds {a}

User: "This is useless to me. I wanted {A}, not {a}"

Developer: "But you never said you were case-sensitive!"

It can easily go the other way, with the user saying "Well i said {a}, but I meant {A}. {a} is useless to me." Who pays when nobody is clearly in the wrong about some ambiguity? The FAQ hints at an "initial 3 month subscription." Am I missing more info on the process?

Link to the report itself: https://assets.documentcloud.org/documents/3863782/The-Holde...

This is a great example of one of those investments that might feel like a waste, until it suddenly REALLY isn't.

I wish I had this video during my infosec & HA consulting days.

It's worth noting this was published in 2000.

Interesting read though, I especially like "Failure free operations require experience with failure" <-- obvious, but easy to lose sight of.

>Outfit ordinary shipping containers

You could also drop one of these into any cargo ship, and have clandestine weapons systems at any major port in the world. I'm guessing this violates volumes worth of international maritime law/treaty... but I can think of at least one organization that'd be comfortable doing exactly that.

Fantastic novel that'll continue aging well I think, esp. if we get more serious about putting civilians on Mars.

I have to confess I didn't see the link to the whitepaper in my first read through - shame on me for commenting before I did :) I think you all did a pretty good job putting this together overall after reading through it, and I applaud the effort. That said, the critical HNer in me sees some bias in the questions and answers. Specifics:

* The results on page 17 jumped out at me the most. There are 4 specific options for negative emotional reactions, and one generic positive option. It's easy to underestimate the powerful effect this has on pushing the responder to a specific answer. Imagine if your answer options were only "content, secure, informed, protected, neutral, misled" and how different your results might be.

* The question for the above, specifically the tone of "[...] does not offer any additional protection [...]" is also a form of leading the responder to an answer. While the statement is mostly true, there's some contention on the point esp. regarding cookies (see the other comments on this thread). Either way, you'd get a more honest answer if you strictly list the things private browsing does, and the things it does not do in a way that's as objective and incontrovertible as possible.

* It would be useful to see the benefits underlying the "correctly identified" category on page 13. I couldn't find those anywhere which was a bit suspicious.

In consulting, I used to survey users on their personal security practices (password strength, adherence to policies, secure disposal, etc.) and gained a huge appreciation for how powerful bias and misinterpretation can be in surveys, and how hard it is to control. But to reiterate, I think this is overall pretty well done and has some really interesting results, esp. the usage data in the first few sections.

This all seems likely to be true, but the source being Duck Duck Go calls the results & methodology into question. I'd love to see an independent researcher confirm these findings.

It's always hard to believe a second-hand story on the Internet, but suspending skepticism for a moment: kudos to the guy for telling this. There's easily enough information in there to be identified by the agents he spoke to. He's taking a huge risk.

Or maybe he included some false info for noise injection... if so, how do we know which parts to believe? Skepticism suspension lifted, I suppose.

I think you're wildly broadening my point to a blanket defense of US military action. That's not remotely what I'm saying. In fact I tend to agree that there's a lot of validity to the whistleblowing of the past decade, and suspect my personal opinions on Snowden, Manning, Gitmo etc have overlap with yours.

But that's not the point. The article is alludes to these "kill boxes" being sanctioned areas of indiscriminate killing. I'm merely clarifying that the ROE still applies (whether or not it's illegally violated).

I'm not a military guy, but was surprised that the weapons-free, kill-anything-that-moves zone described in the article could exist in today's warfare. Turns out it kindof doesn't.

After some quick reading, [1] a "kill box" is still subject to the standard rules of engagement. Its purpose was to make sure everyone is aiming at the same stuff, and to make resupply/logistics work smoothly, not to lift fire restrictions.

Maybe the tactic was abused to circumvent ROE in practice, but the intent seems clear.

[1]: DoD publication: https://info.publicintelligence.net/MTTP-KillBox.pdf

Is a no-return mission something worth considering, on a purely technical & logistical level? Has anyone seen a really good analysis of this?

My sense is that the social, political, and psychological barriers could be overcome for such a thing.

“Where is it, this present? It has melted in our grasp, fled ere we could touch it, gone in the instant of becoming.”

It might be a stretch, but this seems like a small glimpse of the concept of a time differential ('dt'), a thousand years before the math existed to describe it explicitly.

I read your comment before the article. I decided that if this had some "it was a dark and stormy night" opening I wasn't gonna bother. Made it 1 sentence into the piece.