Hacker News Reader

mukyuon OpenAI's Misalignment Framework: A Tactical Bid to Preempt Global AI Governance

How do you think that would go? A large portion of OpenAI workers were ready to jump ship the moment the board coup'd Altman. How do you think they are going to react to Donald Trump being in charge? It is not likely that OpenAI would continue to function.

mukyuon ‘Beyond disgusting,’ says journalist Matthew Keys of his hacking conviction

Ken has a post about it as well:

https://popehat.com/2015/10/08/bad-reporting-on-matthew-keys...

mukyuon It’s Easy to Get Scammed on Venmo

http://engineering.zenpayroll.com/how-ach-works-a-developer-...

mukyuon Windows 95 Startup Sound Slowed 4000%

http://www.erase.net/weblog/2015-08/windows-startup-sounds-s...

http://createdigitalmusic.com/2015/08/windows-startup-sounds...

mukyuon Japanese Day Trader Made $34M from Monday's Panic

That is B・N・F [0], a different famous day trader, not cis. [1][2][3]

[0] https://ja.wikipedia.org/wiki/B%E3%83%BBN%E3%83%BBF

[1] https://ja.wikipedia.org/wiki/Cis_(%E6%8A%95%E8%B3%87%E5%AE%...

[2] https://twitter.com/cissan_9984

[3] http://www.bloomberg.com/news/articles/2015-08-28/while-many...

http://www.bloomberg.com/news/articles/2014-09-25/mystery-ma...

mukyuon Ask HN: What does the percentage next to posts mean?

http://i.imgur.com/nlwvHJK.png an example for those that did not see it

mukyuon Web's random numbers are too weak, researchers warn

The talk about needing to constantly add more entropy or 'manage' it is nonsense. djb says it best: http://blog.cr.yp.to/20140205-entropy.html

Briefly, once you have say 256 random bits it is trivial to use AES and CTR mode and turn that into 2^71 random bits until you need to rekey. If you cannot get more entropy in the time it takes to use up all of those numbers something is completely broken. The only problem you can have is not having enough entropy to bootstrap (such as VMs or needing to generate a key at poweron on an embedded device), but this paper gives little more than lipservice to it.

mukyuon Difficult social problems are still difficult problems

Murray claims that a clause about "reverse-isms" is a cornerstone of a CoC and yet three out of the four resources she mentions as being acceptable do not have one. The only one that does is a community explicitly designed to be a safe space[0] for marginalized groups with a shared ideology. That requirement is perfectly in line with their communities goals. That does not mean it is appropriate for all groups or even all groups that are trying to promote inclusiveness. The argument about "tone policing" and other supposed deficiencies is exactly the same.

The rest of Murray's article is not actually about the actual CoC or any flaws with it.

They did hastly accept the supposed "problems" (that is, it was not a 1:1 copy of the geekfeminism CoC) and tried to fix them. People then complained because they do not believe that things specifically designed for one specific community and are not recommended by most of the experts are appropriate for a general CoC to be used for myriad different communities with far different goals than one specific wiki. TODO then decides that maybe they should actually take some time to think about things instead of circling the wagon around their kneejerk changes.

Garrett then argues that they released something broken and should have consulted the experts and that was one page document is of the same complexity as a 1,000,000 loc kernel. Well, it wasn't broken and it is in line with what most experts suggest, or at least it has not been cogently argued that it was not.

[0] I am using their own definition: http://geekfeminism.wikia.com/wiki/Safe_space

mukyuon MIT cracks Tor anonymity network and identifies hidden servers with 88% accuracy

https://blog.torproject.org/blog/technical-summary-usenix-fi...

mukyuon GitHub threatens to shut down a repository for using the word 'retard'

Aaron Swartz's last interview is really apropos. [1] He discusses how speech has changed and why we should be concerned over private companies' suppressive actions now rather than just governments.

Also, those arguing that governmental assertions of free speech rights only apply to government actions are not familiar with the relevant case law in the US. [2]

Similarly, those claiming that censorship can only be done by state actors are using an incredibly idiosyncratic definition that basically anyone other than a hardcore libertarian would disagree with. [3][4][5] Say it is the 1980s and a college newspaper prints something that upsets someone. They then steal and destroy all copies of that issue once they are printed. How is this action by a non-state actor different enough to be put in another category?

Scott Alexander also has a good read on these issues. [6]

[1] http://www.wired.com/2013/04/aaron-swartz-interview/

[2] https://en.wikipedia.org/wiki/Pruneyard_Shopping_Center_v._R...

[3] https://en.wikipedia.org/wiki/Censorship

[4] https://www.aclu.org/what-censorship

[5] http://rationalwiki.org/wiki/Censorship

[6] http://slatestarcodex.com/2015/07/22/freedom-on-the-centrali...

mukyuon Toyota ad hijacks Siri to switch off iPhones while driving

They think it is a world first, there there was an Xbox one ad[0] that was doing this over a year ago. They could have easily found it just googling "voice command ad" or similar.

[0] http://www.huffingtonpost.com/2014/06/16/aaron-paul-xbox-one...

mukyuon Decapping two chips to compare hardware differences

If you like this sort of thing you'll love Chris Tarnovsky's old blog [0] and talks like this [1] DEFCON talk about ST19WP18 chips where he compares different versions

[0] https://web.archive.org/web/20111111114352/http://www.flylog...? it seems to redirect to a generic ioactive blog which is a real shame

[1] https://www.youtube.com/watch?v=kh238PUqz3I

mukyuon Why Are People Still Playing Ultima Online?

The power differentials in WoW are a lot bigger than 2%. I would wager that less than 90% of the players even are LFR geared, but assume a casual player with a mix of LFR gear, crafted, legendary, heroic BoEs is probably sitting around ilvl 663. Depending on their spec and the fight and playing well they are probably doing 30k DPS [0]. Someone in full mythic 4p (ivl 700+) is going to be doing 55-60k+. [1]

These numbers aren't going to be a perfect comparison because of fight length, strategy changes when you overgear content, skill differentials, etc but gear is pretty important.

One could easily argue that having the highest end gear does not really serve a purpose if you aren't doing any actual raiding or PvP though.

edit: I should probably mention that the last expansion (released last November) did a massive stat squish. In the last tier, t16, an LFR geared player would be doing 30k (ilvl 496ish), 100k (ilvl 528-540), and 1.0m+ (mythic/580+). Player power was increasing so much they had to start working around not being able to increase raid boss HP higher than 2^31 - 1. 25 man heroic Thok had ~2b HP for example.

[0] https://www.warcraftlogs.com/rankings/7#bracket=2&difficulty...

[1] https://www.warcraftlogs.com/rankings/7#bracket=7&difficulty...

mukyuon We can do better – Please fix plaintext credential storage in Chrome

This article is simply incorrect. The passwords are only stored in plaintext when there are no OS-level or desktop environment options available to protect them.[0] In the absence of such a system where exactly do you expect Chrome to store the encryption key for the list of passwords?

[1] https://code.google.com/p/chromium/wiki/LinuxPasswordStorage

edit: Apparently there are people that run either incredibly old versions of chrome or don't run a keystore daemon and actually upload all of their dotfiles to github so I guess that part is technically accurate.

mukyuon Hacking the PS Vita

They famously sued geohot (and others) for their work on the PS3. [0]

[0] https://en.wikipedia.org/wiki/Sony_Computer_Entertainment_Am...

mukyuon Breaking the Zyzzyva encryption

That would presume that the dictionary in question was a copyrightable work. The US has weak database copyright protection due to Feist. There is also Assessment Technologies to consider, but I don't believe that involved the DMCA.

mukyuon White House Sides with Oracle, Tells Supreme Court APIs Are Copyrightable

No action may be brought under this title alleging infringement of copyright based on the manufacture, importation, or distribution of a digital audio recording device, a digital audio recording medium, an analog recording device, or an analog recording medium, or based on the noncommercial use by a consumer of such a device or medium for making digital musical recordings or analog musical recordings. [0]

In fact, the Rio's operation is entirely consistent with the Act's main purpose – the facilitation of personal use. As the Senate Report explains, "[t]he purpose of [the Act] is to ensure the right of consumers to make analog or digital audio recordings of copyrighted music for their private, noncommercial use." S. Rep. 102-294, at 86 (emphasis added). The Act does so through its home taping exemption, see 17 U.S.C. S 1008, which "protects all noncommercial copying by consumers of digital and analog musical recordings, " H.R. Rep. 102-873(I), at 59. The Rio merely makes copies in order to render portable, or "space-shift", those files that already reside on a user's hard drive. Cf. Sony Corp. of America v. Universal City Studios, 464 U.S. 417, 455 (1984) (holding that "time-shifting" of copyrighted television shows with VCR's constitutes fair use under the Copyright Act, and thus is not an infringement). Such copying is paradigmatic non-commercial personal use entirely consistent with the purposes of the Act. [1]

[0] 17 U.S. Code § 1008 Prohibition on certain infringement actions

[1] 180 F.3d 1072. 1078-1079. 51 U.S.P.Q.2d (BNA) 1115 (9th Cir. 1999)

So the law does specifically say that making digital copies of music for non-commercial use is ok and it has been reviewed by the judiciary (to some extent).

There is also 17 U.S. Code § 117 which allows backup copies or computer programs "that such new copy or adaptation is for archival purposes only and that all archival copies are destroyed in the event that continued possession of the computer program should cease to be rightful".

You can still get yourself in trouble related to the DMCA depending on what you are doing, but all of your assertions are false.

mukyuon What is Trolling?

The Ayoade interview mentioned in this article is https://www.youtube.com/watch?v=jjC3ycS_2js

mukyuon Twitter to allow Direct-Messaging anyone

"Now, Twitter said, the direct messages will operate for anyone who chooses to opt-in to the feature."

mukyuon Vulnerability in HTTP.sys Could Allow Remote Code Execution

Blaster[0] was a worm. It used CVE-2003-0352.[1]

[0] http://en.wikipedia.org/wiki/Blaster_%28computer_worm%29

[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0352

mukyuon How to Fix iPhone 4S Wi-Fi Grayed Out – With a Roofing Nail and a Blow Torch

People use methods like towels, hair dryers, heatguns, and ovens to do the same sort of repairs on PS3s and xbox360s so this doesn't surprise me too much.

mukyuon Report: Russians Hacked White House

The incident happened last October so those inferences are clearly spurious.

mukyuon I'll Accept Anything – Accepting every pull request submitted

Various Wikipedia's do have what you are imagining.[0] People are not normally automatically given the right to review changes and even if you do manage to review malicious edits they are easily reverted by others.

Every language has their own policies, but the English Wikipedia only has it enabled on certain pages.[1]

[0] http://meta.wikimedia.org/wiki/Flagged_Revisions

[1] http://en.wikipedia.org/wiki/Special:StablePages

mukyuon New South Wales Attacks Researchers Who Found Internet Voting Vulnerabilities

There is nothing that prevents an online voting system from having a truly secret ballot. There is a class of algorithms[0] designed to compute a verifiable result from private inputs without revealing those inputs. One of the major applications of them being researched is voting.[1][2][3]

[0] http://en.wikipedia.org/wiki/Secure_multi-party_computation

[1] https://eprint.iacr.org/2014/075

[2] http://arxiv.org/abs/1502.07469

[3] https://www.iacr.org/cryptodb/data/paper.php?pubkey=2203

mukyuon John Oliver's Interview of Edward Snowden

https://youtu.be/XEVlyP4_11M?t=953 is a better link

mukyuon Whisper suffers from critical security flaws

It is a bit odd to go to a journalist first with a vulnerability disclosure and then when they are patched poorly to just publicly disclose instead of going back to the vendor. 'Several weeks' does not even seem like an extremely long time span either all things considered.

On the other hand even major players are constantly having low hanging fruit bugs delivered to them very cheaply due to bug bounty programs (like the two recent Facebook bugs). Paying $5k a bug and having no other costs (such as bad press) could be 'cheaper' than actually giving people security training and having audits. If companies started getting burned by these failures maybe they would work harder to prevent them ahead of time.

mukyuon How I got a valid SSL certificate for my ISP's main domain

It was also used to get a live.fi certificate like a week ago. [1]

[1] http://arstechnica.com/security/2015/03/bogus-ssl-certificat...

mukyuon How I got a valid SSL certificate for my ISP's main domain

Email is an incredibly common method for domain validated certificates. The other common options are a TXT/CNAME record or uploading a specific file to a certain URL.

The requirements for domain validation are:

11.1.1 Authorization by Domain Name Registrant For each Fully-Qualified Domain Name listed in a Certificate, the CA SHALL confirm that, as of the date the

Certificate was issued, the Applicant (or the Applicant’s Parent Company, Subsidiary Company, or Affiliate, collectively referred to as “Applicant” for the purposes of this section) either is the Domain Name Registrant or has control over the FQDN by:

1. Confirming the Applicant as the Domain Name Registrant directly with the Domain Name Registrar;

2. Communicating directly with the Domain Name Registrant using an address, email, or telephone number provided by the Domain Name Registrar;

3. Communicating directly with the Domain Name Registrant using the contact information listed in the WHOIS record’s “registrant”, “technical”, or “administrative” field;

4. Communicating with the Domain’s administrator using an email address created by pre-pending ‘admin’, ‘administrator’, ‘webmaster’, ‘hostmaster’, or ‘postmaster’ in the local part, followed by the at-sign (“@”), followed by the Domain Name, which may be formed by pruning zero or more components from the requested FQDN;

5. Relying upon a Domain Authorization Document;

6. Having the Applicant demonstrate practical control over the FQDN by making an agreed-upon change to information found on an online Web page identified by a uniform resource identifier containing the FQDN; or

7. Using any other method of confirmation, provided that the CA maintains documented evidence that the method of confirmation establishes that the Applicant is the Domain Name Registrant or has control over the FQDN to at least the same level of assurance as those methods previously described.

Baseline Requirements for the Issuance and Management of Publicly-Trusted Certificates, v.1.2.3 https://cabforum.org/wp-content/uploads/BRv1.2.3.pdf

mukyuon What to do about re-identification? A precautionary approach to big data privacy

Netflix got sued and investigated by the FTC for the data released for the Neflix Prize contest. One the plaintiffs could be linked to their imdb account by similar reviews and there were additional reviews in the Netflix dataset to imply that they were lesbian while still in the closet.

AOL had to pay a settlement after the search data they released identified people.

mukyuon OpenSSL 1.0.2 ClientHello Sigalgs DoS (CVE-2015-0291)

.. really? Someone else already linked a mirror so I don't need to bother, but I never would have known if you didn't tell me.

That seems like a bit of an over-zealous heuristic for spam. Also, it seems silly to have two different threads just because one URL has https in the first place.