MurphyA/hacker-news huggingface dataset:
by fuzzfactor | 2025-07-09 14:11:23+00:00
>Windows Secure Boot certificates expiring in 2026

>Important When the 2011 CAs expire, Windows devices that do not have new 2023 certificates can no longer receive security fixes for pre-boot components compromising Windows boot security.

>Windows devices for businesses:

>https://support.microsoft.com/en-us/topic/windows-devices-fo...

>This article is targeted at organizations that do not share diagnostic data with Microsoft and have dedicated IT professionals who manage updates to their environment. Currently, there is insufficient information for Microsoft to fully support rolling out the Secure Boot certificates on these devices, especially those with diagnostic data disabled.

Hmm, so far the only proven technique for reliably updating the certificates is for regular consumer Windows users relying on full-auto Windows Update and deep integration with Microsoft servers at all times, not independent enterprises. Either way the motherboards' original UEFI firmware certificates aren't going to be truly updated at this point anyway. So the best fix is not even intended to be permanent. And this is by design? Where every device has a looming Microsoft defect under UEFI, nothing like a BIOS motherboard ever had. And it's a security defect? In the name of security?

"IMPORTANT

The Secure Boot certificate updates offered by Microsoft through Windows Update (WU) are applied to the active Secure Boot certificate variables; these updates are not persistent. If the Secure Boot state on a device is toggled from On to Off, the updates might be removed, as the active variables are reset. Consequently, even if Secure Boot is later re-enabled, the device will no longer retain the 2023 Secure Boot certificate updates that were previously installed through WU. This is because the updates from Microsoft are to the active variables of the Secure Boot certificates and not its default variables."

IOW in a dozen years nobody has come up with a way for millions of computers to remain as secure as they were when originally issued, just because of UEFI & SecureBoot which they are supposed to be experts at?

To be less generous, from another standpoint there are millions of computers happily running Windows 11 right now, where the electronics is in perfect condition and everything SecureBoots just great. In about a year the time will come when the fragility of the feature rears its ugly head and the system can then easily become incapable of booting as securely as it was this year, even though the PC's are still in the same exact top electronic condition.

And that will last forever since it will be incapable of updating the inbuilt certificates by then.

To be even less generous you could say it was just the kind of stupid that you can't fix. Which was obvious about UEFI & Microsoft SecureBoot from the beginning without even knowing about this time bomb.

Root cause has to be a pure defect in something about Microsoft when there is no change in electronics whatsoever.

Talk about design for landfill, if that's not enough you've got to have a scheduled doomsday "to boot".
by pradn | 2025-07-09 14:11:33+00:00
I couldn't immediately find information about how the metadata is stored? Is it one shadow file per RAW file, as I've seen in other OSS RAW editors?

I'm not sure what the perfect solution is, but it is hard to sync a ton of shadow files to cloud storage, versus one big catalog file.

Is the metadata in an open format, so I can take the edits to other programs?

I am glad there's alternatives to having to shell out for Light Room every month. I only need to edit RAW files after holidays!
by jonnycomputer | 2025-07-09 14:12:18+00:00
Yes. Although I'm getting bombed for my statement, it seems clear to me that its behavior took X by surprise. We all know that Musk wants to make Grok less "woke", but despite the whole salute controversy (which I think is way over played, even if I think Musk is a total chud), I don't think Musk wanted X to be sued to oblivion for publishing graphic rape-fantasies against particular Twitter users (Will Stancil).
by PaulHoule | 2025-07-09 14:12:37+00:00
I could box with him all day always stepping to the side with questions like "Do I blame Carlos Castenada or do I blame the people who believed in him?" but to get back to the origin:

Confucius is utterly devoid of "woo" (巫) and is much closer to Aristotle and company than he is to Mary Baker Eddy. Likewise, there's a big Chinese literature in psychology where you'll find things that I believe are true on any level (sadness suppresses anger: try reading names at the war memorial when you are angry but can't be) that are hard to find or absent in Western literature.
by lozenge | 2025-07-09 14:12:39+00:00
We are assuming the calculation for the number of companies affected is correct. If they are using a provider like Shopify or a WordPress plugin, the cost will only be to upgrade the plugin.

I don't know that the backend is necessarily needed. If the button only opened a support ticket/sent an email then the rest can be done by the employees who already processed cancellations on the phone. They just don't need to be on the phone with the customer to do it.
by bryanlarsen | 2025-07-09 14:12:45+00:00
My google-fu is failing to resurface the links, but IIRC:

One study determined the cheapest energy grids for many countries. IOW, if you had to rebuild the energy grid from scratch today, what would be the cheapest way to meet your needs?

And the answer was 90 - 95% renewables, depending on country. Solar + wind + batteries for 90 - 95% of the power, with natgas peakers for the rest. And that 90-95% number increases every year.

Another survey noted that while Australia and many other equatorial countries are optimal for solar, Finland is pessimal. Most countries have already passed the point where solar is best in pure financial terms. Finland hasn't, but it's very close. Which is insane, given that Finland is a poor place for solar, but a great place for wind, nuclear & geothermal.
by ajross | 2025-07-09 14:12:47+00:00
> A symlink can be packaged up in a tarball and shipped from one system to another.

True enough, but if you have a victim unpacking and building untrusted tarballs there's no security boundary being crossed, is there? You don't have to bother with this symlink nonsense, just update the install script to include your payload directly.

Honestly this vulnerability is dumb. I don't see any realistic scenario where it can be exploited by an unprivileged attacker.
by vishakh82 | 2025-07-09 14:12:50+00:00
Think monad as in philosophy, less monad as in a programming burrito.

Our intention is to let each user be a self-contained, enclosed (through encryption) unit where they get insights tailored to their unique genome. At the same time, we want to aggregate data (securely and with consent) from all users to power medical and research findings.

It sort of also works in the programming monad sense as the data is always enclosed and encrypted and never "directly" operated on.
by electroly | 2025-07-09 14:13:08+00:00
I always thought APL was written in the wrong direction. It writes like a concatenative language that's backwards--you tack things onto the front. NumPy fixes it by making the verbs all dotted function calls, effectively mirroring the order. e.g. in APL you write "10 10 ⍴ ⍳100" but in NumPy you write "np.arange(1, 101).reshape(10, 10)". Even if you don't know either language, you can tell that the APL version is the reverse of the Python version.

My hot take is that Iverson was simply wrong about this. He couldn't be expected to predict code completion and then LLMs both wanting later tokens to depend on earlier tokens. SQL messed it up, too, with "from" not coming first. If APL were developed today, I think left-to-right evaluation would have been preferred. The popularity of dotted function calls in various languages makes it reasonably clear that people like tacking things onto the end and seeing a "pipeline" form from left to right.
by alex_duf | 2025-07-09 14:13:12+00:00
>whether the growth of renewables outpaces the depletion of our carbon budget

I'm not sure I understand. There's no carbon budget, any carbon that we emit is carbon we'll have to re-capture somehow and the longer it stays in the atmosphere the longer it will have a heating effect.

I think renewable have accelerated to the point of matching the electricity growth worldwide: https://ourworldindata.org/grapher/electricity-production-by...

We've also passed the peak of CO2 per capita, but since the population is still growing we are still increasing carbon emitions worldwide. It's going to be a while before we stop emitting anything, and then longer before we start re-absorbing it...
by Chihuahua0633 | 2025-07-09 14:13:31+00:00
Matter specifies that all firmware images must be signed so the device can verify authenticity before installation, ensuring they haven’t been tampered with. Matter further requires mechanisms to prevent unauthorized firmware execution and ensure that firmware can't be downgraded.

Matter states that firmware images “may be encrypted.” This is not a requirement, though encryption is allowed and may add security

(https://community.arm.com/arm-community-blogs/b/internet-of-...)
by lopis | 2025-07-09 14:13:44+00:00
I use HA and all my IKEA lamps are zigbee. Raspberry pi obviously doesn't have native zigbee radio support, so I have a USB zigbee antenna. Now this means if I buy any more IKEA lamps, I would need a second antenna, and the new lamps would not integrate into the zigbee mesh network. It really sucks.
by FirmwareBurner | 2025-07-09 14:13:46+00:00
>They did, however think "we will not tolerate the Jewish threat to our aryan volk" - i.e. an openly pro-intolerance ideology.

I never said the Nazis weren't being intolerant, I just called you out for painting those you don't like as intolerant as the Nazis in order to justify using censorship and state force against them in the name of greater good.

If we're gonna go after people for intolerance I expect a lot more proof of criminal wrongdoing and argumentation than just comparing them to Nazis since you're doing exactly what the Nazis did to justify their intolerance towards the Jews.

>"Never believe that anti-Semites are completely unaware of the absurdity of their replies

Not sure how calling people who disagree with you as antisemites helps in any way since I never said anything in support for the Nazis or against the Jews.

Edit: Answering to your reply from below here to not balloon the thread any further:

>"I did not call you an antisemite, I pointed out a common behavioral pattern of antisemites."

So your argument is: "I'm not calling you an antisemite directly, I'm just using a quote to describe your pattern of behavior as being antisemitic." ? Do you even hear yourself?

Like I said before, you're the one who can't stop using Nazis as boogeymen and Jews as a humans shield in arguments all for the sake of emotional manipulation, then call people antisemitic when they disagree with you.
by ansisjxbbx | 2025-07-09 14:13:54+00:00
This is domain specific, but for most web apps

> Fully mocked unit tests are then supplemented with fewer “full stack” tests higher up the pyramid.

Has the wrong priority. Full stack tests are the most valuable for shipping working software. Tests are enforcing contracts between components. Often I’ll see unit tests written for cases that do not exist. This is very bad. Testing at the boundary of your stack ensures the contracts that matter are enforced. Everything else is just making devs wonder “is this requirement actually real?”.

I used to be big on unit tests until I had to maintain a codebase for more than a couple years. I still use them, but mostly out of laziness.
by ben_w | 2025-07-09 14:14:06+00:00
> I pulled a quote about how you should use these things to modify the schema on a live database.

Agh.

I'm old enough to remember when one of the common AI arguments was "Easy: we'll just keep it in a box and not connect it to the outside world" and then disbelieving Yudkowsky when he role-played as an AI and convinced people to let him out of the box.

Even though I'm in the group that's more impressed than unimpressed by the progress AI is making, I still wouldn't let AI modify live anything even if it was really in the top 5% of software developers and not just top 5% of existing easy to test metrics — though of course, the top 5% of software developers would know better than to modify live databases.
by freedomben | 2025-07-09 14:14:24+00:00
Same, that was my first experience as well. It was a breath of fresh air in many ways, and after my initial learning of the new syntax, I quickly became a convert.

That said, I have had some concerns over the years about the growing scope of systemd. I think history has shown my concerns were overblown, though I think it is definitely possible and even likely that people were affected by those arguments and maybe moderated the ambitions a little bit. That could be for better or worse, I don't know, but I do think it was a factor
by K0balt | 2025-07-09 14:14:30+00:00
Thanks for the book recommendation! I’ll look at that.

>> Embrace the uncertainty and move forward anyway.

This. This is the key factor that prevents attempts at success, or leads to failure by a thousand cuts.

There is no gain without risk. Significant gain usually comes through significant risk. Position yourself in life to be sufficiently resilient to take 10:1 bets with 100:1 odds until you can weather the 100:1 bets with 100000:1 odds. Avoid the 1:50 bets that pay at 1:50 odds like the plague… they are a comfortable quagmire of rotting aspirations.
by naasking | 2025-07-09 14:14:35+00:00
> For things like debugger, REPL, or some database inspection/manipulation tool, this approach is useful, but for most apps exposed to end users

Yes, exactly, but the point is that something like Swagger becomes completely trivial, and so you no longer need a separate, complex tool to do what the web automatically gives you.

The additional benefits are on the server-end, in terms of maintenance and service flexibility. For instance, you can now replace and transition any endpoint URL (except the entry endpoint) at any time without disrupting clients, as clients no longer depend on specific URL formats (URLs are meaningful only to the server), but depend only on the hypermedia that provides the endpoints they should be using. This is Wheeler's aphorism: hypermedia adds one level of indirection to an API which adds all sorts of flexibility.

For example, you could have a set of servers implementing an application function, each designated by a different URL, and serve the URL for each server in the hypermedia using any policy that makes sense, effectively making an application-specific load balancer. We worked around scaling issues over the years by adding adding SNI to TLS and creating dedicated load balancers, but Fielding's REST gave us everything we needed long before! And it's more flexible than SNI because these servers don't even have to be physically located behind a load balancer.
by ImPostingOnHN | 2025-07-09 14:14:47+00:00
Thank you for being patient with someone unfamiliar with this tech but nonetheless concerned with security.

> 1. Intercept the eSIM setup QR code (which contains two things: the URL of the SM-DP and a secret profile identifier)

1. How might this be done? Would this require a separate attack, or are the mechanics a part of the attack described in the article?

2. Is this possible with the eSIM already set up on my phone?
by lxgr | 2025-07-09 14:14:50+00:00
That would indeed be catastrophic, but from the attack as demonstrated, I don't think we can conclude that that's possible.

As I understand it, the attack as demonstrated is extracting the eUICC provisioning private key from the context of a SAT applet, but what you're describing would be extracting the keys of eSIM profile A from the context of eSIM profile B of an unrelated carrier.

It would be great to know whether the researchers have looked into that, as it sounds like a much bigger problem if possible.
by cogman10 | 2025-07-09 14:14:59+00:00
Yeah, I take a dim view of the courts in general these days. However, this looks black and white. The FTC was trying to rush in the change before Trump took office and that backfired on them.

Now, the rule is good. There is no reason why the current FTC shouldn't implement it. It literally harms nobody except for businesses addicted to dark patterns.
by bvdr | 2025-07-09 14:15:20+00:00
I created BlueJay, an open-source tool for myself to get better at using the terminal. It's been super helpful and makes my work faster—it’s also a great way to learn!

I am curious if you find it useful and maybe you have any feature requests.

You can find it as a package in the npm repo https://www.npmjs.com/package/@bvdr/bluejay

Example usage: # Ask BlueJay to list files in the current directory j "list all the files in this folder"

# Ask BlueJay to create a new directory j "create a new directory called my-project"

# Ask BlueJay for help with a git command j "how do I revert my last commit"

# Ask BlueJay to help with file operations j "find all JavaScript files in this directory"

# Ask BlueJay to help with system tasks j "show me the current disk usage"
by ivan_gammel | 2025-07-09 14:15:29+00:00
>API users need to know typical latency bounds, which error codes may be retried, whether an action is atomic or idempotent. HATEOAS gets you none of these things.

Those things aren't always necessary. However API users always need to know which endpoints are available in the current context. This can be done via documentation and client-side business logic implementing it (arguably, more work) or this can be done with HATEOAS (just check if server returned the endpoint).

HTTP 500 retriable sounds like a design error, when you can use HTTP 503 to explicitly say "try again later, it's temporal".
by themdonuts | 2025-07-09 14:16:01+00:00
My business is transactional where email is still king for all after sales support. I guess that makes it way easier to handle than a SaaS one.

The biggest impact for the business was not making any sale during this period and my SEO rankings going down. Actually the site disappeared from search. I guess the biggest impact for me - personally - was psychological. All production data was gone and I was seeing it as a sign I should just let it go. I had all the source code, so in theory I could do it, but not sure I would have the motivation to.

Then in the end my thingy was hosted in a section that was salvaged from the fire. I saw it as a sign that actually I SHOULD keep going, lol. I don't remember exactly how long it was off but yeah, 4-6 months. Everything was restored though.

The only thing I did was to implement automatic backups and to a different datacenter. I remember from the incident, one issue for many was their servers were hosted in Strasbourg with backups also hosted there.

I've touched on this in my last comment, but my wife is by far my biggest motivator. It's tough life for us working solo, with our minds playing tricks on us all the time. It always sounds so much easier to go and work for someone else again or to just start a new side project from scratch. Not sure if there's any Alex Hormozi fan here, but one thing he's always repeating is to not give up, not start anything new over and over and just keep pushing that one project.
by yokaze | 2025-07-09 14:16:02+00:00
I create a malicious chart or compromise one you use (with symlink to an arbitrary file and code).

You download charts either as a tarball from a helm repo or oci registry with helm and helm will create the files and links with your permissions, and send me whatever I wanted to extract from your system.

Yes, you should check things you download from the internet. But also, that is not how a chart is supposed to work.
by osigurdson | 2025-07-09 14:16:15+00:00
It is true, if you say "RPC" I'm more likely to assume gRPC or something like that. If you say "REST", I'm 95% confident that it is a standard / familiar OpenAPI style json-over-http style API but will reserve a 5% probability that it is actually HATEOAS and have to deal with that. I'd say, if you are doing Roy Fielding certified REST / HATEOAS it is non-standard and you should call it out specifically by using the term "HATEOAS" to describe it.
by bracketfocus | 2025-07-09 14:16:45+00:00
This makes sense. A lot of end-users have internet speeds that can outpace the decompression speeds of heavily compressed files. Seems like there would be an irrational psychological aspect to it as well.

Unfortunately for the hoster, they either have to eat the cost of the added bandwidth from a larger file or have people complain about slow decompression.
by danwills | 2025-07-09 14:17:14+00:00
Agency is the ability to reach goals, even when there are obstacles. Given information such as stimuli, agency is the ability to act/react to that information in such a way as to move the agent closer to their goals.

In the plant case, among many other interesting things (fungal interactions, say) I think of examples like: How roots grow towards water/nutrients (even if rocks are in the way). How leaves/branches can lean-or-orient-towards and grow-towards sunlight. The kind of self-healing that this article describes, and the overall way in which everything a plant does tends to lead towards it being able to reproduce via seeds or spores (or one of the many other ways that plants can reproduce!).

I'll freely admit my perspective on this is influenced a lot by Michael Levin's work around hierarchies of agency (many vids on YouTube) In many of his talks he describes how agency can be treated as a measurable quantity, like something from engineering. This places it far from philosophical or abstract definitions and more in a cybernetic realm where agency is a measurable thing and can either be instructed from outside (like a thermostat) or from within - like when a hungry animal (or plant) seeks food - and as you go up the scale-level for agency you get entities that can legitimately have (and achieve) clear longer-term (and spatially larger) goals. Smart animals - such as humans - can even with a mostly-straight-face talk about and put into place plans that would reach far into the future compared to their own expected lifetime.

So yeah I agree plants certainly can't comprehend BBC2, but I think if that's the definition of agency then we're really not talking about the same thing.

I agree that plants worry about light and water, but they don't just sit there and do nothing! They respond to it with their agency, maybe it's an agency we find hard to recognize and don't fully appreciate and we'll often say it is small/slow or disregard it, but I personally think that plant agency is made of the same stuff as human agency (and we just have a special word for it when it's us: consciousness).
by shagie | 2025-07-09 14:17:29+00:00
The literals would be identified at parse time.

fooLit = "foo" fooVar = "f".concat("o").concat("o")

This would have fooLit be frozen at parse time. In this situation there would be "foo", "f", and "o" as frozen strings; and fooLit and fooVar would be two different strings since fooVar was created at runtime.

Creating a string that happens to be present in the frozen strings wouldn't create a new one.
by severak_cz | 2025-07-09 14:17:42+00:00
I am already working on something similar yet much smaller - simple, easy to use 2D CAD for hobbyists, maps and geometric art. I have working prototype implemented in lua (Love2D) [0] and barebones text based file format[1].

Curently I am experimenting with drawing things in DeltaCAD (another easy to use CAD - unfortunately abandonware now), converting it to my format (via DXF export) and displaying it with javascript. I want to reimplement second version in javascript to be able to run it in browser and use better GUI components than those which I tried to implement myself.

[0] - https://github.com/severak/graph-paper

[1] - https://github.com/severak/graph-paper/blob/main/doc/file-fo...