danra

It's probably just Facebook's AI thinking that protesting against the government is dangerously close to suicide, and so protecting its users accordingly.

It's impossible to explain the Segwit2x bugs ignoring the social aspect.

The planned fork was supported by only part of the community, which would not have been a problem if it weren't for the lack of replay protection, which would have lost many people money had the fork been activated. The rationale for not having replay protection was to take over the Bitcoin network as a whole, with the lack of differentiation from the 'legacy' Bitcoin network being seen as a feature. In other words, rich people with a lot of mining power were planning on forcing the network into accepting their own rules (with most people in the network, running SPV wallets, doing so unknowingly), and if people lose money in the process, well, that's just too bad.

And that's just what touched me the most personally. There were a lot of other things in the Segwit2x process to be appalled with, such as the anti-developer culture, the infamous NYA closed meeting and general lack of transparency, and more.

Because I was disgusted with that bully approach, I did not invest any serious time reviewing the Segwit2x code changes, but instead did spend time studying, reviewing and contributing (my very small bit) to the Bitcoin Core code. I guess that other developers similarly had no drive to contribute to the Segwit2x codebase. I also think it's probable some people have found the bug/s and did not report them so as not to help bullies get their way.

In conclusion, the lack of review and testing, leading to the bugs, is not just a technical issue. Doing serious review and testing of open source code relies on support from the community, which was minimal, because very few competent developers in the space who understood what was going on wanted to help.

A lot of the responses here are missing the point. It's not that Apple must behave morally with regards to taxes, and not just legally.

It's that Apple claims to behave morally, and doesn't.

An ambiguous title, came in expecting this to be about someone quitting his job at Facebook.

Which you absolutely should do if you work there. Facebook has an obligation to its shareholders to maximize its profits, which (possibly) means its strategy of monopolizing everyone's social identity is a valid one (though hopefully it could be mitigated through anti-monopoly laws, see the recent trend in the EU).

But no talented programmer has an obligation to help Facebook fulfill their strategy. If you care about freedom, don't help its opponents.

CppCast episode:

http://cppcast.com/2017/04/sara-chipps/

It's pretty insane this sort of bug either passed or didn't even go through code review and testing at Apple, a company which has approximately infinite resources and whose marketing pitch is making high-quality products.

I loved Apple products and still do, but as both a user of and a developer for their systems, I feel the quality has been steadily going downhill the last few years.

The time estimate listed for an in-depth reading of the Yellow Paper (54 minutes) is... optimistic.

> Academia’s mission is to get every academic paper ever written on the internet, available for free

> In considering what features to offer in the Premium account, we decided that features related to the mission of the company should be free

That's absurd. Open access to an ocean of articles without the ability to search through them is meaningless.

While you do allow search in titles, thus providing some ability to locate relevant material, presenting content search as some premium feature in 2017 is ridiculous.

Does this provide a new constructive way of mapping a space (which would be exciting) or just a proff to a known conjecture which is already being used to map spaces? (also cool but not as much)

I've been using daily contacts for years until I had a minor irritation in my eye for a few days, went to see a doctor, who told me I have an infection and I'm in real danger of losing my eye. Got antibiotics and luckily everything turned out OK.

I got the impression that eye doctors are not big fans of contacts, and that my situation wasn't uncommon.

Had a LASIK shortly afterwards, worked out OK, so far of course. I'm sure it has risks, but I haven't seen proof those are worse than contacts'.

The research was obviously funded by Coca-Cola.

As a TL;DR, or even as a starting point for diving deeper into the finer points in the talk, it would be really helpful to attach the complete code which demonstrates type erasure.

I should have been clearer. I really expected them to announce a free repair for anyone suffering from the issue, not to keep ignoring it like they have so far, even when the problem is obviously effecting many customers.

So disappointing they just decided to ignore "touch disease". Bad form.

"Papers, Please", of course... I'm not worthy of glorious arstotzka.

Anyone else reminded of Passport Please? Imagine having to recognize a fake passport by a slight difference in symbol/text format :)

I've avoided buying a code signing certificate from Comodo just because of their reputation, even though they offered the cheapest price.

To me, this behavior reinforces that that was the right decision.

For 'wonderfully', only the 'wonderful' part is redacted, so you get '---------ly'. Not sure if this is a bug or a feature :)

I simply hate it when Waze navigates me through a dozen small streets I'm not familiar with, just to save one minute vs. taking a main road. The multiple suggested routes often don't mitigate this enough.

Wish for a feature to turn a preference for main roads in general.

What do the !XT, !B, !U etc. mean in the commit messages?

A cool addition would be to augment the IAT hook with an option to hook LoadLibrary and GetProcAddress, so that functions imported from delay-loaded DLLs are also hooked correctly, and so that the IATs of delay-loaded or otherwise dynamically-loaded DLLs would also be hooked.

Here's a script that detects the Anguish characters (except for the Byte Order Mark \ufeff, which isn't that rare):

  exp="\u2060|\u200b|\u2061|\u2062|\u2063|\u200c|\u200d"
  git log -p --pickaxe-regex -S"$exp"

Someone needs to make a script which runs through a git repo's commit history and looks for commits which add invisible Unicode characters. Maybe some existing exploits could be found in the wild.

Why not pass over management of the repository to someone else? Sounds like all sides would benefit.

> It's like a Microsoft employee wrote about vulnerabilities in Windows on their private blog, offering to sell solutions.

A company controlling its employees' contact with the media in order to serve its business interests is not the same as publicly-funded government employees being gagged to serve some specific political party's interest and disserve the public interest.

It's good to invest time in making decisions and coding them when it actually ends up making a positive difference to your work. Otherwise, by definition, it is premature optimization. (of performance, design or otherwise.)

For instance, you often figure out you don't need a piece of code only after you've written and tested it, or after your thought process about the design has evolved. When you delete that code, it doesn't help anyone that a couple of hours ago you've invested five minutes in picking the "right" data structure for the implementation. The right data structure for unstable code is the one which lets you work with it and takes up the least of your time. As your code becomes more stable, it could then make sense to invest time in picking and coding a better data structure; it's less efficient to do so prematurely.

No.

In Herb Sutter's words, avoiding auto since it makes the code "unreadable":

...reflects a bias to code against implementations, not interfaces. Overcommitting to explicit types makes code less generic and more interdependent, and therefore more brittle and limited. It runs counter to the excellent reasons to “write code against interfaces, not implementations”

See http://herbsutter.com/2013/08/12/gotw-94-solution-aaa-style-...

I don't see how the CSO's response makes sense for Facebook's security interests. As CSO, it is in your interest to allow a researcher to exploit an RCE to its furthest. Otherwise, you would only ever allow researchers to inoculate your outest layer of protection, while leaving any inner level untested and thus less secure.

If indeed only credentials and technical information were obtained, all aimed at finding more security issues, Facebook should be thankful for finding all the vulnerabilities across all their security layers.

Nice, looking forward to the sequel ;)

By the way, let's say I don't "remember" which other branch contains a file at a certain path - what's the easiest way to find all other branches which contain a file at that path?

"And in its perfect state"