danielvf

This interview was exactly this thing. It filtered out Adam. :)

Job interview for a potential hire: Candidate had a decent resume with previous experience, had passed the initial non-tech interview, and seemed excited about the job. We talked about the job and how they would approach doing it.

Came to the part of the interview where we do about five minutes of sample work - very basic, no tricks.

Candidate opened up screen sharing, stared at the screen for a few seconds, and then unleashed a tirade about about how much they hated the role we were hiring for and that they had quit their previous job doing this because they passionately hated this job, etc.

It was shocking to have them go from excited about X to ranting about X. Still don't know what was going on.

For those looking for context: https://news.ycombinator.com/item?id=41128441

Two months ago someone a 2 million dollar bug bounty, and it was top on HN. [0]

So, no this is a good bounty but still on the small size for a huge crypto project / company.

[0] https://news.ycombinator.com/item?id=40710201

Here's some context, and some fun drama.

One month ago this same company found a bug with a 2 million dollar bug bounty.

The bug would let them drain funds from a crypto exchange by sending funds to the exchange on the blockchain, but then after sending, reverting the part of the transaction that sent the funds, while keeping the overall transaction alive. The software at the exchange was fooled into counting the reverted transfer as actually happening. [0]

So what do you do when you find an incredibly critical bug with 2 million dollar bug bounty?

CertiK researchers choose to steal 3 million.

Then when they stole it, they exchanged the bulk of the coins for other coins, and sent some of the funds to an OFAC sanctioned entity. CertiK did not report the massive bug that they were exploiting live, in the wild, in public view, for ten days. When they finally did report it for the 2 million dollar bug bounty, CertiK did not mention the 3 million dollars that they stole. When confronted about it, they referred all questions to the sales team, who made demands and refused to return the money. Two weeks of refusing to return the money pass by, and before the head of security at the exchange posts on Twitter the story [1], without naming the company.

So what do you do now there's a now a story out there that some researchers stole 3 million and won't return it.

CertiK chose to confirm everything on their official Twitter, loudly proclaim that the team that stole the money was them, and claim that the exchange was persecuting them by threatening legal action for the return of the stolen funds. CertiK founders also retweeted these tweets.

After a firestorm of twitter drama, by the end of the day, CertiK promised to return the stolen funds.

So CertiK is just some random team of anonymous people, right? Nope.

CertiK is 2 billion market cap, company, headquartered in the US, just did 230 million dollars worth of fund raising.

(CertiK does have a long reputation for working in ways that no one could conclusively prove if their actions were from evil or from incompetentance.)

[0] https://x.com/danielvf/status/1803780167027871878

[1] https://x.com/c7five/status/1803403565865771370

[2] https://x.com/CertiK/status/1803450205389402215

This paper is most likely complete bunk. The data is very bad, and the conclusion doesn't even match the data.

See previous comments when this was posted yesterday.

https://news.ycombinator.com/item?id=41111236 (data)

https://news.ycombinator.com/item?id=41111416 (conclusions)

I agree with you - both the data and the conclusions drawn from that data are fairly out there.

And there's only 16 adult faces used. If even one of these had a skewed name, that would be a bigger effect size than the entire experiment.

I find the conclusion unlikely to have the effect size they describe and there are two similar explanations that fit the data better.

Take the name "Maria" in the US. In the 1930's a girl with that name would have strong odds of being from a Catholic background, probably from a large family, maybe Hispanic/Italian/Porto Rican. Then the film the "Sound of Music" came out, and the number girls of being given the name Maria tripled in the 1960's and 1970's. And these new Maria's were born to parents who were trying to evoke a white, blond, energetic, musical Austrian image.

The "stereotypes" associated names change each generation. One big of tell of this, from the linked study, is that adults don't revert to chance on children's names, but are in fact actively worse than chance. In fact, adults are more "worse than chance" on matching children than adults are "better than chance" a matching adult faces.

It's not that adults aren't getting data from looking at children's faces, it's that they are mapping what they are getting to an incorrect mapping!

The early USSR was at least two orders of magnitude worse than the czars, if you score either by yearly executions or by yearly sent to Siberia.

And that's not evening counting the USSR's millions "resettled" in ethic operations, with about a 20%-25% death rate.

https://en.wikipedia.org/wiki/Population_transfer_in_the_Sov...

And then we have the epic years in the 1920's of famine from screwing up the agricultural system, and selectively choosing ethic groups to take food from, the dwarf the famine deaths under the czars.

A surprising law foundation in the US is that if you live somewhere long enough as if you were the owner, then it becomes yours. Sometimes known as "squatters rights". This feels a bit unfair at first.

However, this "if you think you own it, you probably do own it" has turned out fairly well. At least in most places in the US, unlike England, you don't have to trace all property transfers back to Norman Conquest in 1066 in order to know who owns land. Anyone who holds it long enough resets the baseline date at which you need to trace it back to.

This "article" is SEO spam and appears to be written by an LLM. Don't waste your time.

I was somewhat surprised as well at the phrasing here, and had to look it up. During Assange's time in the Ecuadorian embassy, he fathered two children by a female lawyer hired to be on his defense team. [1]

[1] https://en.wikipedia.org/wiki/Stella_Assange#Personal_life_a...

Here's an explanation of how Certik attacked Kracken's deposits:

https://x.com/danielvf/status/1803780167027871878

Certik did hard work to find the bug - testing many of exchanges over many blockchains. But everything after finding that was firmly in crazy land.

Waiting multiple days to disclose, stealing 3 million dollars, swapping the stolen coins to coins, laundering some of the theft through OFAC sanctioned entities, and then not even returning the exact amounts they took is just mind boggling, and that only after public pressure.

And then, to take it to the next level, tweeting over and over again once Kraken disclosed that a vulnerability had been reveled, grabbing credit for being evil, posting timelines of crimes, and insisting that they were the victim. It's amazing. In a serious world, this would be an amazing example of what to never do as a social team.

There's an entirely legitimate question here behind this quip.

I don't think there's a magical answer, but one approach I've found is to try to be a mini expert in a tiny, tiny slice of a bigger area (usually bridging over knowledge from some adjacent area I know). This means that I can then evaluate those who talk about this tiny area, and get a good baysian guess as to there broader expertise from there.

The project changed to a 1 million dollar bounty after usmannk's report on May 18th..

There's an unofficial project that tracks bounty programs, you can see the change here: https://github.com/infosec-us-team/Immunefi-Bug-Bounty-Progr...

[I was wrong, see below]

The bounties in crypto are so big because the math is so clear on the cost vs benefits of the bounties. Paying two million to avoid losing a billion is not a bad deal. And there just aren't enough security people yet that market forces have commoditized bounty finding.

Good companies use bounties as yet another security layer - after doing everything else, add a bug bounty!

Almost all crypto bug bounties run through Immunefi. [1] There are lots of > one million dollar bounties. You can see SEI's current bounty page here.[2] The company I work (a different company) for has a one million dollar bounty listed on immunefi.com and median response time of six hours.

[1] https://immunefi.com/bug-bounty/

[2] https://immunefi.com/bug-bounty/sei/

You can see lots more here:

https://immunefi.com/bug-bounty/

My understanding is that the overall move towards almonds is actually a move towards crops that are efficient in terms of dollars of income for a fixed amount of water.

Wheat exports for $250 per ton of wheat. This month almonds export at $3,783 per ton. (This is actually down quite a bit from before and is resulting in fewer almonds being grown this year.)

In other words, given that farmers have a roughly fixed allotment of water to work from, if you completely banned all almond growing from CA, farmers would just use that same water on other plants and water usage would not change at all.

You can see the UI for UK's divorce lawyers in this training document[1] pdf. It's not actually that bad, but the payment flow only shows case numbers, not names.

----

However, the headline for this article is a bit misleading. It sounds like the lawyers just divorced a random married couple, and the judge refused to undo it.

But if you go through the article, and put together the clues like a game of Dog Crimes, you get the following sequence of events:

1) The wife hired a speciality divorce law firm. 2) The law firm had already completed all divorce paperwork and uploaded documents into court web system for the wife divorcing the husband. 3) The law firm accidentally selected this "case" to submit and pay for, rather than another intended case. 4) Per UK law the husband would have been officially notified of the completion of the divorce. 5) The wife was not happy about this surprise. 6) The wife's law firm went to court to undo the divorce. 7) The husband hired his own lawyers to keep the divorce. 8) Given that all the paperwork was correct filed, and one member of the couple wanted to keep the divorce the judge let it stand.

[1] https://assets.publishing.service.gov.uk/government/uploads/...

A fun article!

I think a more probable understanding of the "Daniel" reference in Ezekiel is that it is same Daniel from the book of Daniel.

Even if you assume that the prophecies in the book of Daniel were written retroactively 600 years later (given the accuracy of described events) it does not preclude an actual powerful person of that name being alive at same time as Ezekiel, and being the basis for later attribution.

Both Ezekiel and Daniel are written covering a similar set of years. Both refer to a person named Daniel widely famous for his "righteousness". It would seem improbable that they were talking about entirely different people.

Again, had a lot of fun reading that.

Some context on this article.

This article is targeted at proving programs that run on blockchain based virtual machines.

These VM's are deterministic to their core. This is quite different the envirnoments that than most programs run in. For example every time code on the EVM runs in production, it is being run in parallel on hundreds to hundreds of thousands of systems, and the outputs/storage writes/events all have to agree exactly after execution, or bad things things happen. The EVM is also single threaded, reasonably well defined, and with multiple different VM implementations in many different languages. So programs here are much easier to verify.

In addition, program execution costs are paid per opcode executed, so program sizes range from hundreds of lines to about thirty thousand lines (with the high side of that being considered excessive and insane). It's again quite different than the average desktop software, or even embedded, program size.

I have both used fuzzing tools (actually working on reviewing a fuzzing setup today) and formal verification in the past. I agree with the article that currently fuzzing provides a similar level of verification for considerably less effort. Current formal verification systems in the blockchain based virtual machine space are extremely difficult to write good specs for, and extremely easy to write broken specs that don't check what you think they do. On the other hand, good enough specs for fuzzing are fairly intuitive, even if great specs still take a lot of expertise.

If I had a math heavy set of code that I wanted to wring the last possible security assurances from, I'd go for formal verification on top of fuzzing. But for most other work, I'd pick fuzzing.

(Disclosure, I've been a customer of Trail of Bits, and worked with two of the three authors in the paper)

(This isn't to say that form verification will never catch up! I'm thankful for the hard work from the people who have been moving it forward - it's gotten much better over the last two years. One day maybe it will be just as easy.)

Every Russian naval ship sunk by Ukraine in 2024 has been sunk in sight of land, at a small port or bay that they have been stationed at.

It's not that Ukrainian USV are making pinpoint attacks in a vast ocean, rather they are driving over to a port that a ship has been hanging around for months.

- Ivanovets, sunk in "Lake Donuzlav", where it had been for months - Tsezar Kunikov, sunk in sight of Alupka, and located right where drones would pass on their way around Crimea. - Sergey Kotov, sunk in the tiny confined space of the port next to a bridge it was guarding.

This has nothing on Alaska, where you can sign up to be called by the Highway Patrol when they find roadkill.

https://news.ycombinator.com/item?id=39538648

In Alaska you can sign up to be put on a rotating list to be notified of, and collect, free meat from highway roadkill.

Had a friend who had the biggest pickup truck in a small community. He would calls at all hour of the day and night to come help the lucky receipt of a phone call from the Highway Patrol bring home free food.

Actually Darwin himself was writing about natural selection, human breeding, and races in 1871 [1]

> With savages, the weak in body or mind are soon eliminated; and those that survive commonly exhibit a vigorous state of health. We civilised men, on the other hand, do our utmost to check the process of elimination; we build asylums for the imbecile, the maimed, and the sick; we institute poor-laws; and our medical men exert their utmost skill to save the life of every one to the last moment. There is reason to believe that vaccination has preserved thousands, who from a weak constitution would formerly have succumbed to small-pox. Thus the weak members of civilised societies propagate their kind. No one who has attended to the breeding of domestic animals will doubt that this must be highly injurious to the race of man.

https://en.wikipedia.org/wiki/The_Descent_of_Man,_and_Select...

Galton, the "Father of Eugenics" was already proposing eugenics related things in the 1860's, and by the 1900-1910 it was getting into full swing in the US.

I don't know anything about mars, but I've messed with windmill math. This really doesn't make sense to me.

A 150 mph wind in 1% atmosphere should be a way stronger a 1 mph wind on earth?

You know the old formula,

force = mass * velocity * velocity

But with wind and water the more velocity, the more mass you get hit with in the same amount of time, so we get to multiply by velocity again.

wind force = mass * velocity * velocity * velocity

(This formula is why people die in fast moving water.)

So a Mars 150mph wind (0.01 * 150 * 150 * 150) would have 34,000 times more force than a 1mph wind on earth. Which works out to around a 32 mph earth wind.

You can read the whole document, not just this section here:

https://www.cia.gov/static/5c875f3ec660e092cf893f60b4a288df/...

My read on the section on management has always been that here we moved from theoreticial means of sabotage (cross electrical wires in cable, then plug it into multiple outlets around your apartment to blow as many fuses in the building as possible so that your neighbors can't listen to a propaganda broadcasts) to something that the writers had had deep personal experience with in previous jobs. The OSS was defined by their being outside the old stuffy system, and I'm sure this was a dig at the bureaucracy they were trying to escape from. In the OSS way of making things happen, they didn't want speeches or buck passing.

Here's a scoring guide to "how good" a statement is, along with examples.

https://ofew.berkeley.edu/recruitment/contributions-diversit...

Here's a scoring guide from a US university for DEI statements. To me it's much more informative to go to primary sources for what is selected for, rather than only reading about them second hand.

https://ofew.berkeley.edu/recruitment/contributions-diversit...