Nut allergy info that was collected by the school (teacher, admin, nurse, whoever) is part of the student records and would be protected information under FERPA.
The original error was the network command, but the slower response and lengthy outage was partially due to the physical security they put in place to prevent malicious activity. Any event like this has multiple root causes.
Yes, but the fact that the blogpost concludes on this relatively tangential note (which notably also conveniently allows Facebook to brag about their security measures) and not on the note that their audit code was apparently itself not sufficiently audited, is what makes this deceptive spin.
I agree that there's an awkward emphasis on how FB prioritizes security and privacy but nothing is deceptive here. Had the audit bug not subsequently cut off access to internal tools and remote regions it would be easy to revert. Had there not been a global outage nobody would have known that the process for getting access in an emergency was too slow.
Huge events like this always have many factors that have to line up just right. To insist that the one and only true cause was a bug in the auditing system is reductive.
Our postmortems have three sections. Prevention, detection, and mitigation. They all matter.
Shit happens. People ship bugs. People fat-finger commands. An engineering team’s responsibility doesn’t stop there. It also needs to quickly activate responders who know what to do and have the tools & access to fix it. Sometimes the conditions that created the issue are within acceptable bounds; the real need for reform is in why it took so long to fix.
No, they just wanted to cover both "what caused it?" and "why did it take too long to fix it?" since both are topics people were obviously extremely interested in.
It would have been surprising and disappointing if they didn't cover both of them.
Seems like appropriate emphasis given how many people yesterday were asking why aren't they back online yet. For every person asking why they deleted their routes there were two people asking why they didn't put them back.
Tempus enables precision medicine through the practical application of artificial intelligence in healthcare. We have one of the world’s largest libraries of clinical and molecular data, and we use that to train and ship ML algorithms that can help doctors choose the right therapies specifically for their patients. The goal is for each patient to benefit from the treatment of others who came before by providing physicians with tools that learn as Tempus gathers more data.
I lead the Algos Engineering team. My team ships AI models driven by molecular (DNA and RNA), clinical and imaging data. We've recently shipped algorithms that drive new therapies to patients (see https://www.tempus.com/additional-testing/ ) with more on the way. This is some of the most exciting and cutting-edge research in the industry, and I am lucky to work with an exceptional data science and medical team every day.
We are hiring for
* Software Engineers
* Engineering Leads
* Designers
* Dev Ops
* Data Scientists
If you are a software engineer with a passion for seeing machine learning in production use by real patients, either apply to the role at https://www.tempus.com/careers/job/?gh_jid=4525173002 - or reach out to me at luke.shepard@tempus.com .
I didn't see it as defending sexism. It was more pointing out the hypocrisy of Apple for firing Martinez while selling and promoting 'Beats by Dre'. In both cases the creative works were well-known before the hire/acquisition.
Pointing out that hypocrisy is a strategy some took with criticizing Apple, but it's not the direction PG chose. [1]
He said nothing about Dre, focusing entirely on saying "He's a good guy, actually", which is the epitome of the strategy taken by men historically to defend other shitty men.
That's not "defending sexism" per se, but it is excusing sexism because of the content of someone's character. "Sure he said sexist things but he is not sexist". It does not pass even the most baseline level of scrutiny.
I think it's also worth saying here that the comparison to Dre is super irrelevant:
1) Musicians may write lyrics in the first person, but the general default for all musical content is it's "fictional", and not representive of their personal views on the matter. It's artistic license with ideas - occasionally problematic. That is not the case with "autobiographies", which is what Antonio's book was purported to be.
2) Dre has taken complete ownership of all of his past indiscretions and apologized for them [2]. Antonio double down.
Which is a poor critique considering Martinez would be working directly with other Apple employees while Dre is barely involved with Apple as far as I know. The issue isn't the creative work alone, the issue is the impact on fellow employees and the working environment.
In Chicago especially (where the study was based and where I live), police fairly clearly have an overuse of force in general. They have paid enormous sums over many years in lawsuits for wrongful use of force. There is plenty of research to show that when confronted with complex problems police will respond with force when other tactics may have been better for all (such as cited in this book - https://www.npr.org/2019/01/02/681606995/punishment-without-... )
That is directional evidence, not the kind of evidence needed for a study like this.
Assuming we accounted for every one of those court cases, would that nudge the data? Are there 100x cases that 'never made it to court' for every case that did, or only 2?
How wide is that Gaussian distribution of assertive policing? Is it limited to a specific unit? Or a specific tactic, i.e. no-knock warrants?
What was the nature of 'over policing' in those cases, vs. the kind of issues that police face daily? Because typically, it's going to be the 'egregious' issues that go to court, probably not 'the little things' and of course the 'little things' might be the real problem, or not.
Are some police letting people off the hook for serious things aka "I saw you with that gun in your belt, son, I'm not going to ruin your life in this moment because you remind me of me when I was your age, but you need to get that thing home and put it away, if I see you on this block again I'm going to check up on you". Which FYI might actually in some ways be a rational policing tactic - or not - it's hard to know.
Or is it almost entirely a function of profiling and the likelihood for police to act given certain bits of information, whereupon the actual type of applied policing might be the same?
Maybe it's the reaction of the offenders - perhaps young men of colour are really that much more likely to not flinch when someone 'who looks like them' approaches?
Paradoxically 'more policing' in the broadest sense seems to lead to less crime, at least by some measures [1], but that doesn't take into account level of assertion.
There are too many variables to just assume that police are, in most cases under or over policing with respect to application of the law.
Terraform prints out the number of resources changed and at least requires a "yes" to proceed. Not quite as onerous as described but at least prevents some type of fat-fingering. Basically all changes with Terraform are risky as they usually involved bringing up and down infrastructure.
Terraform will perform the following actions:
# google_compute_instance.vm_instance will be created
+ resource "google_compute_instance" "vm_instance" {
+ ... <more>
Plan: 2 to add, 0 to change, 0 to destroy.
Do you want to perform these actions?
Terraform will perform the actions described above.
Only 'yes' will be accepted to approve.
Enter a value: yes
This is exactly the problem the author is referring to. With Terraform, you always type "yes" to proceed, so it turns into muscle memory. You stop reading the output, and you're already typing "yes" before you even see the prompt. Terraform's output is also verbose, and many changes show up as "1 to add, 0 to change, 1 to destroy" because they don't separately list a "replace" category. It's pretty bad; you've got cognitive overload, confusing output summary, and a predetermined continue answer. And this is often an action you're performing under duress. I've been bitten by it plenty of times.
Yes, because we designed the internet and web "wrong".
I've commented with my opinion on this, here on HN, before. In my opinion, the world should have two internets: the current internet, and a "safe for life" internet.
The former would serve as a staging area and playground for new features. Just as the internet does today, it would provide, roughly speaking, no accountability and no security. My guess is that its main audience would be high-school seniors and college-age kids. In addition, you'd have a minority of techies, and — yes — some vile wingnuts.
The "safe for life" internet's network-layer would have baked-in authentication (eg: part of your IP is a user-id). It would have a protocol for notarization (ie: the ability to have a third party vouch for information. eg: the choice to tie your real name to your user-id, or remain pseudonymous). Its "web" markup would be far simpler and more semantic (no per-site styles, no dynamic features, no scripting).
When someone invents a very useful web feature/paradigm on the old internet/web, the new internet's web-standard could add special tags to support it. So, for example, the NewW3C could introduce a set of "store-front" tags with which one could create an entire online-store without any scripting. The NewW3C would include all sorts of functionality, eg: tags to host a Twitch-like site to stream video, with no JS whatsoever.
With this sort of accountability, the alternate internet would finally provide the ability to effectively moderate — bad actors wouldn't easily "respawn" a sockpuppet or bot account, to evade a ban. It would make commerce and data-sharing much safer (via the lack of dynamic features).
The situation today is absurd. What content do we want the web to promote: interesting photos of Japanese food, by a serious developer... or hackneyed ramblings by a bunch of 20-year old trolls? The internet we have today is "wrong" for most people.
This is an interesting idea, but it wouldn't have helped in this case. The trolling on Github was using a logged in account; this would exist within the "safe internet". The co-ordination of this occurred in 4chan, which would likely be in the "unsafe internet".
With your proposal, the trolling would still happen, but it might have been harder for her to track down where it was coming from.
Trolling is a societal issue, not a technological one.
The trolling on Github was using a logged in account
Except, if Github bans the user, that user (the actual human being, not their worthless handle) is gone — banned permanently. That's both a disincentive, and a rate-limiter.
Also, if the abuse is egregious enough (ie: a death threat), the troll is now in legal peril. The cost/benefit of reporting a troll to the police (even under a pseudonym) on the new internet is much more attractive. Currently, trying to track down an IP is fairly worthless. It's not tightly-coupled to a human being.
Trolling is a societal issue, not a technological one.
We disagree on this, but — let's be honest — there's no way to prove either position conclusively. I'm tempted to bombard you comparisons and contrasts from the various historical periods, but I doubt it would convince you. There are myriad counter-examples with which you could reply.
My take is that the internet, in its current form, enforces so little accountability, that it gives bad actors far more power than good actors.
Are you seriously proposing totalitarian internet? So let's think who would adopt it first. My guess: China, Russia, Belarus, maybe even North Koreans would finally join internet.
I should have stressed that the new network-layer would support the old internet. So, for example, a user might have a Firefox.app window open on their screen (connected via TCP/IP and displaying a normal HTTP website), and a also an AltBrowser.app (connected via AltTCP/IP and displaying a new AltHTTP website). Sort of like the Tor-paradigm, only if Tor required you to update your router's firmware.
I think, in such an environment, the old internet would still be the first choice of most 20-somethings (aside from when they online-shop). Why? Because young people tend to seek excitement, danger, conflict, boundary-pushing, etc.
The new internet likely would be the primary choice (probably the sole one) of oldsters, toddlers, parents, researchers, sensitive souls, retailers, and so on
I'd be skeptical of a safe-for-life Internet for one reason: safety. Experian, Target, OPM... we've seen countless times that very entities the average person does business with [un]voluntarily can't be trusted with a person's details or credentials. All it would take is for one corporation to mess up and someone else would own a person's one and only safe-for-life identity which, as you noted, means they'd own their victim online entirely. Even if there's an appeal process, since the safe-for-life ID would have to be worldwide, ostensibly it'd be even more difficult for victims than it is to get a new SSN. It's a nice thought, but I wouldn't be willing to trust anyone, especially an organization like Experian that I can't even opt out of, with the safety of what amounts to my professional and a fair amount of my personal online life.
That's an excellent point. I didn't address this aspect today, but I touched on it a little in a HN comment I posted a couple months back.
Ideally, the identity-side would be handled in a distributed way through a network of brick-and-mortar notary businesses. An account "for life" wouldn't be so iron-clad as to ruin someone's life. It would be onerous in the sense that one would have to pay a fee to the notary, and provide government ID to replace their account. At which point (after which the original, compromised user ID is marked as invalid).
The point you make re: security-issues with retailers is relevant, but it applies primarily to the businesses who notarize users, probably not the retailers.
As an example of the difference, the user could request the notary electronically confirm to the public that the user has a high school diploma, but not reveal any details re: from which school, or from which year. I haven't thought this through, but I could envision a "Mailboxes Etc" type business providing both notary, and PObox/reship services so that other retailers couldn't even find out a user's address.
I don't think you'd need a separate internet for that. You can have some kind of ID system where you can authenticate to a site with your ID. Some sites essentially use small credit card payments to do this already. This commonly helps prevent ban evasions in online games that cost money.
You could be right when it comes to the network "piece." The reason I proposed it is to enforce identification tied (indirectly) to a single human being, in perpetuity. It would also be attractive to make transmission of old-style web traffic over the new network difficult, to avoid the existing web subsuming the new one. There may be other ways to wind up with the same result. Ha! Maybe neither way is possible! The internet is so complex, it's hard to reason about.
Probably the user would have to dig out their birth cert, and visit the notary they originally used to get internet access. Then the notary would contact their ISP (or maybe they push the update to their public records, and the user asks their ISP to pull the update) with the replacement user ID.
Whatever the specifics, the basic idea is that there be a one-to-one relationship between a user and their account.
https://www.assemblyai.com/