Hacker Newsnew | past | comments | ask | show | jobs | submit | arcwhite's commentslogin

YT's skateboard introduces the telescopic contact smartwheels pretty early on as a Courier essential.

I don't recall Hiro's motorcycle being much a part of the story, it might also have had the smartwheels but isn't discussed until later...


Yep. His motorcycle is introduced in great detail and then afterwards Stephenson deliberately trolls us with "...after that, it's just a chase scene" and it's never mentioned again. ;)


I would love mailing lists to be a thing again, but the experience of using email is just so bad for me. The sheer amount of unsubscribing I have to do to make it usable - not even taking spam into account - makes email a place I don't want to spend any time.


I tried to order - looks like you're not shipping to Australia? Any plans there?


To some extent? But then we have lobby groups, PACs, regulatory capture and astroturf campaigns that have proven to be quite successful techniques to subvert the political process.

I'd argue that those techniques put us back at the mechanistic system being elevated above other values.


I think "assume good faith" has to be taken as something of a Prisoner's Dilemma proposition.

You don't want to be a dove, and keep assuming good faith when it hurts.

Assume good faith initially because it least has a chance of being productive, but the moment bad faith is detected, either withdraw or "punish" (and propagate social signals that bad faith arguing has been detected so others know not to engage)


>Assume good faith initially because it least has a chance of being productive, but the moment bad faith is detected, either withdraw or "punish" (and propagate social signals that bad faith arguing has been detected so others know not to engage)

That's fair but I think a better solution is to enter into a conversation Tabla Rasa; you don't know someone's a kook/troll/whatever but you are aware that they may be. They may also be a potential friend/workmate/source of support/whatever.

With each interaction, over time, trust is either built up or torn down.

This is harder and harder to do in the current forum/anonymous posting climate not so much because of anonymity but because of different design elements that have stripped people's messages of ways to make distinctions (avatars, signature are two that come to mind, profiles are another).

Now posters all blend into one another so building up any kind of individual rapport is difficult; if not impossible.


Thanks for clarifying this. It made me reflect on the relationship between assuming positive intent, negative intent and blank slate as directly corresponding to strong positive and negative priors vs weak priors or even uninformative priors.

Even updating these priors with new data to form posteriors falls perfectly into place. Thank you.


It's been good to have the chance to articulate my annoyance and examine it closer and think of what alternatives I'd propose. I'm glad to have something more to go into future discussions with than inarticulate gripes. All in all a net win IMO!


Where are you getting this theory that there was an impact event that.killed off both the megafauna and the Clovis people's off?

Everything (credible) I'm able to find suggests/theorises that the Clovis differentiated into different groups of Native American populations, and that gradual climate change did most of the megafauna in.


There have been many interglacials and only in one did the megafauna die out en masse. This is a good argument against it simply being from climate change.

Instead look to what was different in the most recent one. A weird species on 2 feet with hunting techniques that the megafauna had never encountered before. Such as using fire to drive whole herds of horses off of a cliff.


Not plausible. Humans at much higher density had been able to drive island populations to extinction, but had not succeeded on a continent. Furthermore, they had been in the Americas for many millennia already.

Horses and camels were all over Asia, coeval with humans, and did fine. Lions survived in in Europe well into recorded history. Africa, of course, retained about everything for hundreds of millennia, except for 3 genera right at 12800 years ago. The only notable extinction in Eurasia was the woolly mammoth, which survived only on Wrangel Island. Humans had been in the Americas for many millennia, but populations of these animals did not decline during that time.

Instead, the 30+ genera and the Clovis people all vanished at identically the same time, coincident with the layer of radically elevated platinum dust, shocked quartz, and soot.


Extraordinary Biomass-Burning Episode and Impact Winter Triggered by the Younger Dryas Cosmic Impact ∼12,800 Years Ago.

Authors: Wendy S. Wolbach, Joanne P. Ballard, Paul A. Mayewski, [+24 others]

Journal of Geology, 2018, volume 126, pp. 165–184

http://sci-hub.se/10.1086/695703

Abstract: The Younger Dryas boundary (YDB) cosmic-impact hypothesis is based on considerable evidence that Earth collided with fragments of a disintegrating ≥100-km-diameter comet, the remnants of which persist within the inner solar system ∼12,800 y later. Evidence suggests that the YDB cosmic impact triggered an “impact winter” and the subsequent Younger Dryas (YD) climate episode, biomass burning, late Pleistocene megafaunal extinctions, and human cultural shifts and population declines.

The cosmic impact deposited anomalously high concentrations of platinum over much of the Northern Hemisphere, as recorded at 26 YDB sites at the YD onset, including the Greenland Ice Sheet Project 2 ice core, in which platinum deposition spans ∼21 y (∼12,836–12,815 cal BP). The YD onset also exhibits increased dust concentrations, synchronous with the onset of a remarkably high peak in ammonium, a biomass-burning aerosol. In four ice-core sequences from Greenland, Antarctica, and Russia, similar anomalous peaks in other combustion aerosols occur, including nitrate, oxalate, acetate, and formate, reflecting one of the largest biomass-burning episodes in more than 120,000 y.

In support of widespread wildfires, the perturbations in CO2 records from Taylor Glacier, Antarctica, suggest that biomass burning at the YD onset may have consumed ∼10 million km^2, or ∼9% of Earth’s terrestrial bio-mass. The ice record is consistent with YDB impact theory that extensive impact-related biomass burning triggered the abrupt onset of an impact winter, which led, through climatic feedbacks, to the anomalous YD climate episode.


Lots of people suggesting that either company was out of line here, but like, CFAA is still a thing (assuming OP is in the USA) and it's still got gnarly teeth. Let alone the possibility of industrial espionage allegations...

If you're going to go hack on a company, make sure you have some legal protection first. Check disclose.io or the company's website (look for a security.txt!) to make sure there's some sort of safe harbor provision, or a pre-existing vulnerability disclosure program or bug bounty program that allows you to do this kind of testing.

If you're not going to do that, then disclose the vulnerability anonymously and cover your ass while you're testing, or just don't.

Meanwhile if you're an American please write your local representative and express your displeasure with the antiquated, overly-simplistic CFAA and ask them to support initiatives to have it replaced or removed.


CFAA isn’t going away.

> If you're not going to do that, then disclose the vulnerability anonymously and cover your ass while you're testing, or just don't.

No. Just don’t. Know that video about not talking to the police because they interrogate people all day long and you’re an amateur in a pro fight? Same thing with infosec. We attribute IOCs to noobs all day long.

You don’t need a criminal record. It’ll ruin many parts of your life. I have friends who can confirm that the record they got in their late teens or early 20s closed many doors. Join a formal bug bounty platform and find legitimate work there.


> CFAA isn't going away

There's some pretty concerted efforts in play to at least have it updated and tempered, which could have legs. I don't hold much hope it'll go away but I do think some of these efforts to have it replaced could have legs.

> No. Just don’t.

Yeah, fair, I mean I'm all too aware of the consequences myself, but within this setting telling a bunch of people "thou shalt not" seems almost more harmful (IMO it's akin to saying "never roll your own crypto" which someone inevitably ends up taking as a challenge)


Until we fix the laws, I'd suggest just letting the world burn until voters and lawmakers get tired of half the country's personal data being stolen once a month and make a safer landscape for hackers to report vulnerabilities.


I do hope those efforts succeed. I think the parent meant to state "hasn't gone away," but even if they didn't, the point remains if you replace that.

I hate the CFAA, to be clear; it's just definitely still the law.


Industrial espionage is not involved here. This is just reverse engineering that escalated into something that might be misconduct.

Espionage would include things like illegally surveilling the competitor's networks, bribing their employees for information and credentials, using malware to create backdoors, social engineering, blackmail, poaching their talent and incentivizing unethical disclosure of trade secrets, and cracking systems that explicitly bar access.

Reverse engineering their product through public IPs is legally acceptable up to CFAA boundaries, which are fuzzy, and it's not clear what kind of exploits were involved in this situation. They may have been relatively benign reverse engineering, or they may have been something associated with civil and criminal penalties.


From exactly where do you draw the conclusion that "reverse engineering a product through public IPs is legally acceptable up to CFAA boundaries"? What are those "CFAA boundaries"? There is no exception to the CFAA for "reverse engineering"; there is only exceeding your authorization, or not.

There is a lot of authoritative writing about the legality of reverse engineering (long story short: reverse engineering is mostly fine, legally) --- but that writing covers reverse engineering stuff running on your own computer. It categorically does not extend to reverse engineering software running on other people's computers without their permission. You'd easily get into a bunch of trouble assuming otherwise.

A lot of terrifying stuff on this thread! It's good this person already has a lawyer.


I agree with you that reverse engineering does not extend to anything one pleases on the internet.

I also don't see game-modders or game cheaters regularly going to prison even though gaming is an enormous industry.

So clearly there is some tolerance as connectivity being ubiquitous blurs the line a bit though. An app I reverse engineer on my device, may as a side-effect make some communications with a third party asset, though primarily it is all my stuff. The same applies to a cars and other items, surely.

That being said financial account creation is definitely NOT the place to take risks. Same with government systems. Pretty quick many other laws and regulations ij the book come into play. They can be very broad too.


The bright line here is between code running on machines you own, and code running on machines you don't own. It's not complicated.


You personally reverse engineering an app on your phone has been quite well established as legal.

You releasing a competing product after having personally worked on reverse engineering someone's product is a lot murkier, and easily opens you up to copyright lawsuits, which you'll have a hard time fighting if you do happen to have similar code, since in copyright it matters not just if the code was similar, but also whether it's likely that you actually copied it (unlike patent law).

This can and has been done, but normally you want a very clear firewall between the reverse engineering team and the dev team, with lots of paperwork proving that no-one on the dev team ever saw a line of code from the reverse engineering team - they were only told concepts and ideas, which are not copyrightable. This is how the first free Unix was created, for example.


The perception of the possibility of the perception of industrial espionage is usually enough to get a lawyer choked up in cases like this - I wasn't saying there WAS industrial espionage, just that there might have been the possibility of painful allegations thereof...


I hope one day you are never a victim reading some asshole talk down to you about why it your fault.


Yeah, lick that boot!

> Tens if not hundreds of thousands of people go to prison each year in the US and don't feel the need to kill themselves

Plenty do, and plenty die while they're in prison. This is not a rational justification for what happened to Schwartz (and looks to me like victim-blaming)

> Would we blame that person's ex?

I mean if the ex had maintained years of abuse and was threatening the person's life - yes? Yes we would?

Blaming mental illness is an utterly weak response here. Many, many people struggle with mental health and don't commit suicide; the assumption that mental health issues == suicide is reductive and harmful.


>Plenty do, and plenty die while they're in prison. This is not a rational justification for what happened to Schwartz (and looks to me like victim-blaming)

It is not attempting to be a justification for what happened to him. It is demonstrating that Swartz was not acting rationally. You shouldn't blame someone for triggering an irrational response by another person. And it isn't victim-blaming to say someone is dead because of their mental illness anymore than it is victim-blaming to say someone is dead because they had cancer.

>Blaming mental illness is an utterly weak response here. Many, many people struggle with mental health and don't commit suicide; the assumption that mental health issues == suicide is reductive and harmful.

You are the one being reductive and equating all mental health issues to suicide. I am talking about one specific person with mental health issues. Talking about Swartz's mental health history is important. If he got the help he needed at the right time he might still be alive. Talking about that aspect of the story can help save the lives of people who feel similarly trapped as he felt.


Andy Good, Swartz's initial lawyer, told The Boston Globe: "I told Heymann the kid was a suicide risk. His reaction was a standard reaction in that office, not unique to Steve. He said, 'Fine, we'll lock him up.'

http://bostonglobe.com/metro/2013/01/15/humanity-deficit/bj8...

https://en.wikipedia.org/wiki/United_States_v._Swartz

Multiple prosecutors (Ortiz, Heymann), the judge (Gorton), and institutions (MIT, JSTOR) wantonly pursued an extreme perversion of justice in full knowledge of Swartz's mental state.


Funny that you left out the next couple of sentences in that quote: "I’m not saying they made Aaron kill himself. Aaron might have done this anyway."

But either way, what do you think the response from the legal system should be in this situation? Should "my client is a suicide risk" be a path to reduced sentencing? I think that is a huge can of worms. Authorities should certainly work to protect people in their custody to prevent suicide, but I have a hard time agreeing with the idea that they have a responsibility to be more lenient against potentially suicidal defendants.


Again: given a full warning of the problem, judge and prosecutors expressed extreme indifference.

Certainly not judicious exercise of their discretion.

All for a victimless crime.

And rather than express some modicum of sympathy you point out the humour in the situation. (What humour, I'm not even going to begin to ask.)

I couldn't disagree with you more strongly.


Not funny as in humor, but definition 2 and 3 of "funny"[1]:

>2: differing from the ordinary in a suspicious, perplexing, quaint, or eccentric way

>3: : involving trickery or deception

The overall quote agreed with me, but you removed that extra context to make it agree with you.

You also did a good job of avoiding giving a definitive answer to my question because you realize your answer sets a difficult precedent. Should "my client is a suicide risk" be a path to reduced sentencing?

[1] - https://www.merriam-webster.com/dictionary/funny


You're doing an equally good job of avoiding expressing any empathy and human concern your response instead with again defending your own position and word choice.

I'll offer you another opportunity with your own question:

Should "my client is a suicide risk" be a path to reduced sentencing?


My empathy is going to the people who are alive and suffering from similar mental health issues today that could be helped if we told the truth about why Swartz is dead.

I answered the question in the first comment.


> Multiple prosecutors (Ortiz, Heymann), the judge (Gorton), and institutions (MIT, JSTOR) wantonly pursued an extreme perversion of justice in full knowledge of Swartz's mental state.

What is JSTOR doing on that list? After Swartz was identified and arrested, JSTOR said that they would not pursue a civil case against him, and they were not interested in seeing him criminally prosecuted. As far as they were concerned the downloading had stopped and the matter was done.


I'd hope it would encourage them to be slightly less passive white knights in future.


Reads better without the first line.

(And yes, I often fight the temptation to insert a line such as that where it's richly deserved. Usually successfully. If I can't, I try to at least be creative and somewhat indirect.)


> I mean if the ex had maintained years of abuse and was threatening the person's life - yes? Yes we would?

In fact, we have!

https://www.huffpost.com/entry/jessica-haban-domestic-violen...


Bugcrowd | Multiple Roles | Hybrid Remote (Australia, US) | Full-Time | https://www.bugcrowd.com

Bugcrowd crowdsources hackers and applies them to cybersecurity work to find and fix critical vulnerabilities faster. We facilitate bug bounty programs, vulnerability disclosure processes, penetration testing and we're looking to enable more hackers to do more types of work (and, importantly, get them paid for their efforts) to keep our customers safe on the internet.

Tech stack: React, Typescript, Ruby on Rails, Kotlin, Kafka, Redis, PostgreSQL, Terraform, Docker

We're looking for:

- Mid and Senior Software Engineers (all timezones)

- Product Designer (Australia)

- Front-end Design System Engineer (Australia)

Infosec is a challenging design space, and so are double-sided marketplaces! Come help us design and implement the service-oriented platform that facilitates interactions between hackers and corporate security.

The team is looking to expand significantly in the coming year, so you'll get to have meaningful impact on product and engineering decisions and there is huge room for career advancement (including active mentoring from talented staff engineers, senior designers and senior product managers).

We're committed to hybrid remote - we won't force you back into the office, but we'll make it an option if you want to. Pay, perks and options are competitive, and we're strong proponents of conditions better than merely 'work/life balance'.

Check out our careers page: http://bugcrowd.com/careers or email me: andy@bugcrowd.com


In my experience automated tools are generally fairly rubbish for this kind of work... which is not to say it's impossible, just that you'd want some real smarts in said tool


Consider applying for YC's Fall 2025 batch! Applications are open till Aug 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: