HN user
Shameless plug:
At baseshift.com we're building a solution to this. We generate isolated clones of production databases and expose operational control of clones via MCP (start/stop/reset). This provides agent autonomy for development and analysis workloads without risking production.
We support PG, MySQL, MariaDB, and MongoDB (more coming). We're currently in private beta but we're happy to onboard fellow HNers!
To be clear, it didn't take my keys. It generated a wallet to which I sent my bitcoin, which was then promptly sent somewhere else.
Mistake #1 : switching to an even more closed computing environment, where user has strictly no control
I've been with Google Nexus and Pixels for many years, roughly starting with the Nexus One. Ironically, I switched from an iphone 3GS at the time that I owned for a few months.
After many years of being on windows, then linux, then Mac, then back to linux, now back to Mac with linux on ssh, my conclusion is that user control doesn't necessarily mean a better user experience. A closed computing environment allows for consistency and sturdiness. When you start looking at your phone as a device, rather than as a computer, it becomes obvious.
Mistake #2 : running on a tech. stack you do not control: closed-source, walled-garden
I don't control android in any way. I could read its source code if I really, really wanted to but why would I? I want a product. A device. Would you read the source code of your washing machine? Dish washer? At some point you want to live your life and stop reading anything and everything as if you actually have enough time to tinker with all of it.
Mistake #3 : using a wallet instead of your own private cold storage to hold any kind of significant amounts of money
Meh. 'Significant amounts of money' is subjective. Some would say the amount of money I lost would be a life changer, some would shrug it off as a yearly bonus on the lower end of the scale. Fact is, I had my bitcoin on some version of a pixel for roughly 7 years and never had a problem.
Mistake #4 : trusting that Apple is making huge efforts to secure their environment.
They made a huge effort to secure their hardware; its some of the best in the world. The thing is they put a ton of focus on hardware security but hardly enough on software / service stuff. In this case, the app store search was compromised by some bots leaving reviews.
Your general theme seems to rely on having access to open source on all levels leads to more security.
This is patently false. For example, the vast majority of smartphones use baseband processors that are not just closed source with closed source drivers, but the ICs themselves are tightly guarded secrets by their manufacturer (probably Qualcomm). There are probably a dozen or so chips in every smartphone running all sorts of firmware you have no access to. Same goes for computers.
In fact, I would argue that Apple's model might be the most secure, because they do SoC, which requires they know far more about and have much more control over the inner workings of every sub component.
When I installed it, it was the #1 organic search result. Other commenters report seeing the same app as #2 organic search result.
Just because an account is newly created does not make their first post FUD. Their story is precisely what happened to me, although for a slightly smaller amount of money.
Yes, but how does following the tx trail help me in any way? They've moved the BTC a few times since the wallet sent it to them.
I didn’t put a seed phrase into the app. I created a new wallet in it and transferred the btc to it.
Others have reproduced it, see others comments. Perhaps for them the ranking changed slightly but the fact is a scam app is ranked as high as serious companies.
Gmail / Google are open, the App Store is closed and supposedly vetted and guarded. Apple sells to its customers security, quality, and trust. It’s one of the reasons one pays 2x for an iPhone. All of these promises of a better ecosystem have been broken through this experience.
One of the supposed advantages of the closed App Store is to absolve (to some extent) the user of having to do said due diligence.
Also, it’s not like it’s impossible. Google are doing it well - show me a scam app that’s in the top 10 of the play store for bitcoin, banking, finance etc. Hardly any to be found.
If only there was a website I could use to contact other like minded people where they could vote on posts they like and discuss them in comment sections.
Oh, wait
How am I supposed to prove I didn't seek the app out? What level of proof do you expect? Do you expect me to create a brand new apple account, replace the one in my phone (which might require wiping it?), and then search again, just to satisfy your default assumption that my claim is false?
When I first installed the app it was the first search result. I can't go back in time and prove it because I'm not paranoid and I don't screenshot the result of every search in every app store and search engine.
I reported it. I'm not trying to rally a mob against Apple. The bitcoin is gone.
I'm trying to prevent others from suffering the same fate as me. Based on what I'm reading in the comments here some other people in the world do trust apple app store search results, and I believe they've gained something from my post.
(1) How much more valuable do you think it is to the scam app developer to appear at the top of the search results than for a legitimate wallet developer?
Well, the scammer got CAD $150k out of the reddit guy I linked to and I lost a slightly smaller amount - and we're just two out of who knows how many thousands of app store users that installed this app. I'd say people trust the top 5-10 results quite a lot.
(2) Do you think a legitimate wallet app will engage in the same black-hat SEO tactics a scam app developer will?
I think all the black-hat SEO in the world should not be able to surpass the obvious value disparity compared to legit apps with hundreds of thousands of installs and hundreds of reviews.
Posted above the screen recording: https://streamable.com/y5nhy7
You can't escape personal due diligence and "it was top ranked!" has never been that.
On one hand that's a fair point and I should've known better. OTOH I think it is legit to trust top app store search results to return quality apps, especially if there is a massive disparity between their quality. The scam app has obvious repetitive spam reviews. The developer's website is terrible and the submit button doesn't even work. This is basic quality control on apple's part. If every single app store user needs to manually vet every single app they install to the proper extent there would be a fraction of a fraction of the installs and respectively, a fraction of a fraction of the revenue.
Consider the extent of lawsuits between apple and companies with app store apps - does it not strike you that apple protects that revenue stream? Wouldn't it make sense to give app store users a sense of trust in the top search results?
Fair enough. I removed it and recorded the screen again: https://streamable.com/y5nhy7
Here is a screen recording including this hacker news post + your comment & and a switch to the app store with the search phrase. The first result is the scam app. I scrolled down so you can see where serious apps are in the list of results. https://streamable.com/q2mulu
I just took a screenshot of the app store about an hour ago: https://pasteboard.co/bZ7qQvAzYggy.png
It wasn't a promoted result, it's an organic search result, and it's still there!
In hindsight, this is quite obvious. Coming from years of using Google Pixels I just got used to trusting the search results. I've never hit a fraudulent app when searching in the Play Store. I trusted apple that at least the top 5 results would be legit. EDIT: added the word 'top' at the end
Honestly, I got lazy, and that's on me. I was using the standard bitcoin wallet app on android. It did seem weird I can't restore the wallet I backed up in the android app, but the android app github doesn't point to an app store app, so I figured there just isn't and the android app's backup format is something detached.
Then I figured a legit apple app could generate a wallet and I could transfer the bitcoin between them. Which is what I did. The apple app indeed received it and promptly sent it off somewhere else. What's even crazier is that the apple app shows this info! You'd expect the scammer to hide the scam but I suppose it just made it easier to pass the app store inspection.
You're right, I shouldn't trust a random app. Also, it's pretty much my first serious foray into Apple land. I trusted Apple's search results. There are multiple apps, far more mature and backed by serious developers, that would also match the phrase "Bitcoin Wallet".
The question is why is the scam app the #1 organic search result? For a new app with such scammy reviews and questionable metadata I would expect it to be #30 in the list. For context, the app store reports the scam app as #85 in all finance apps.
You're right, and I've done both. My review doesn't appear in the list of reviews.
What's crazy is that a scam app is the #1 organic search result for 'bitcoin wallet', above blockchain.com and coinbase.
Nice work! If I'm not mistaken, the root requires morphological disambiguation, which may change depending on the context/phrase in which the word is observed.
This is an active area of research in Morphologically Rich Languages (MRLs), since this problem also appears in other semitic languages like Hebrew, as well as Turkish. There's a nice body of work to learn from, both with and without neural nets. For example, this paper from 2017 (http://aclweb.org/anthology/D17-1073) uses a neural model for morphological disambiguation. You can see a nice comparison of tools in the recent 2018 Universal Dependencies Shared Task results: http://universaldependencies.org/conll18/results-lemmas.html (look for ar_padt).
If you're looking for training data, the Arabic treebanks in http://universaldependencies.org could help. I think some of them contain surface tokens with lemmas. I'm quite sure they also have roots.
Also, you might want to take a look at the SIGMORPHON CONLL shared task (2017 https://sites.google.com/view/conll-sigmorphon2017/ and 2018 https://sigmorphon.github.io/sharedtasks/2018/) on morphological reinflection, which IIRC is a similar task - taking an inflected form and reinflecting it with other morphological properties. They also have a nice data set to train on.
RIP
Yoav's response to general criticism https://medium.com/@yoav.goldberg/clarifications-re-adversar...
Yoav's response to Yann https://medium.com/@yoav.goldberg/a-response-to-yann-lecuns-...
Accompanying response by Yann LeCun on FB:
Google's SyntaxNet (as of Andor et al 2016) achieves state-of-the-art accuracy for dependency parsing without RNNs.
Adding electronics (or worse, software) adds a huge amount of attack surface. The attack could be at any point from the CPU-internals to the software.
You're missing the point. The voting protocol is built in such a way that you can verify that your vote was cast as intended, and that your vote was counted in the tally. Once everyone agrees on the voting protocol you don't need to trust someone else's electronics, you can do it on your own device, and use open source software.
the voting protocol doesn't provide a means of verification Yes. That's a feature. Any new system cannot re-enable voter coercion.
You can have vote verification without enabling coercion. If you have a vote receipt it does not imply you can prove or disprove how you voted, but it does allow you to verify that your vote was included in the tally.
More importantly, the reply by marten-de-vries[2] brings up a very good counter argument to any voting system based on fancy math: the general population won't accept it. The voting process doesn't work unless the population considers it legitimate, and it will be hard to convince them if they first have to learn enough math to understand homomorphic (or public-key) encryption.
I disagree. The general population doesn't know how RSA or AES work but we have HTTPS and the green-lock-thingy. You don't need to know how or why something works in order to reap its benefits.
That's not a valid argument. Nothing is secure from all known threats.
The question is how (in)secure is the system. In this case, the voting protocol doesn't provide a means of verification.
Secure voting protocols have been around for quite a few years. jjuhl left this comment above https://news.ycombinator.com/item?id=13032602
Dan Boneh's Crypto 2 coursera course (https://www.coursera.org/learn/crypto2#) covers the concept.
There are voting protocols that use the same foundations as public-key crypto to allow for vote verifiability - you can validate that your vote has been taken into account in the tally without sacrificing the privacy of your vote. There are solutions for voter fraud too.
I won't be at ACL this year, maybe next. My advisor will be there though (Reut Tsarfaty).
Dependency Parsing by Nivre et al was a good source for catching up from an NLP course to state-of-the-art http://www.amazon.com/Dependency-Synthesis-Lectures-Language...
Yes.
I didn't see noticeable improvements from TSS either. I did some performance tuning - much more time goes to feature extraction and scoring. Can you elaborate on what you mean by 'hashing the "kernel tokens" and memoising the score for the state'? Are the kernel tokens something like the head of stack/queue?
For feature caching, I went with a generic model for a feature template as a combination of feature elements (for features like S0t+Q0t+Q1t) that have a closed set, so the feature template is limited to a set that is a cartesian product of the elements' sets. When you initialise parsing for a new sentence, you can select a subset of the possibilities to generate a "submodel" for only that sentence. That way you need much less memory. If you can pack it properly you can get a lot of it into the lower level caches which should allow for significant speed up.