MurphyA/hacker-news huggingface dataset:
by strcat | 2025-09-10 01:30:50+00:00
The early ARM Cortex MTE support has full support for synchronous and asymmetric (synchronous on reads, asynchronous on write) modes. Asynchronous was near zero cost and asymmetric comparable to a mitigation like MTE. This has been available since the launch of the Pixel 8 for Android. GrapheneOS began using it in the month the Pixel 8 launched after integrating it into hardened_maloc. It currently uses mode synchronous for the kernel and asymmetric for userspace. EMTE refers to FEAT_MTE4 which is a standard ARM extension with the 4th round of MTE features. It isn't Apple specific.

MTE is 4 bits with 16 byte granularity. There's usually at least 1 tag reserved so there are 15 random tags. It's possible to dynamically exclude tags to have extra deterministic guarantees. GrapheneOS excludes the previous random tag and adjacent random tags so there are 3 dynamically excluded tags which were themselves random.

Linux kernel MTE integration for internal usage is not very security focused and has to be replaced with a security-focused implementation integrated with pKVM at some point. Google's recently launched Advanced Protection feature currently doesn't use kernel MTE.
by ignoramous | 2025-09-10 01:31:26+00:00
Unfortunate Daniel Berlin did not push Google to invest in MTE for security specifically, like Apple has done now with EMTE (MTE v4?). I mean, AOSP is investing heavily in rewriting core components like Binder IPC in Rust for memory safety instead... They also haven't resurrected the per-app toggle to disable JIT in ART for Java/Kotlin apps (like DVM's android:vmSafeMode)... especially after having delivered on-device "Isolated compilation" but (from what I can tell) only for OS (Java/Kotlin) components.

AOSP's security posture is frustrating (as Google seemingly solely decides what's good and what's bad and imposes that decision on each of their 3bn users & ~1m developers, despite some in the security community, like Daniel Micay, urging them to reconsider). The steps Apple has been taking (in both empowering the developers and locking down its own OS) in response to Celebgate and Pegasus hacks has been commendable.
by strken | 2025-09-10 01:31:31+00:00
I'm not as familiar with the US, but Australia moved from requiring teachers to complete a 1-year graduate diploma, to a 2-year master of education. This is effectively doubling the commitment for someone to transfer into teaching from another field.

Requiring anything at all is by definition an artificial barrier. Some are justified and some are not. In this case, I question whether a longer education necessarily benefits students.
by duxup | 2025-09-10 01:32:13+00:00
>"They all tell me they’re aware of a monopoly problem, and they don’t deny it exists. But they do nothing. Instead, we get bailouts and the money slips right out of our hands and into the big corporations we owe the money to — the monopolies. Meanwhile, those same corporations lobby for us to get the bailouts. Get it?"

I get that frustration.
by artemisart | 2025-09-10 01:32:25+00:00
Do you know about other security issues? If it's only about curl | sh it really isn't a problem, if the same website showed you a hash to check the file then the hash would be compromised at the same time as the file, and with a package manager you still end up executing code from the author that is free to download and execute anything else. Most package managers don't add security.
by sbinnee | 2025-09-10 01:33:05+00:00
I switched to 12 mini about a year ago from 1st gen SE because it broke down. I agree that it would be more than enough for years to come.

I cannot agree more on the event video. It looks like a pure TV ad for a full hour long. Also, it used to cover more diversity in terms of presenters. Where are they now? I want to hear lovely accents from people all around the world.
by johnnyanmac | 2025-09-10 01:34:20+00:00
>I challenge you to find any citation in any contract written by any BigTech company where legal would ever let them put in a contract that they guarantee that you will never have to work in an office.

Why do you assume I have access to every employee's contract? Have you never negotiated terms?

I don't have someone's direct contract but I worked directly with two people who had very particular stipulations for when and where they can work. One at a medium sized studio who basicallyhelped establish core tech they use to this da. One from a director at big recognizable company. They were both talent who clearly could shop and bid for jobs anytime and anywhere they wanted to.

It's not common, but we're not talking common talent. Anyone can negotiate, what you get in the contract depends on a variety of factors.

> Do you think that lawyer is going to work pro bono?

I don't know. I'll ask them about it the next time we ever meet.

I'm not really a fan of pre-maturely giving up. If I really feel wronged, a consultation isn't that expensive in the grand scheme of things.

> What are the chances that these multi trillion dollar companies are making these kind of policies without passing them by their team of lawyers?

Higher than you think. Hanlon's razor applies here.

Again, I'm not sure why you're so against the idea of deferring to an actual expert. At worst you waste a fee hundred dollars and hours of your time. At best, the company was dumb and they settle under the hood so you can at least get a bit more piece of mind.
by re | 2025-09-10 01:34:23+00:00
> Unless you can deliver multi-day battery, it's useless to provide anything more than all day battery

The battery time estimates are based on certain usage patterns, not 100% utilization of power-hungry apps. A battery that can last "36 hours" can offer more real-world usage per day than one that only lasts for 24.

Edit: Looks like the only estimates Apple provides any more are video playback hours, which is much more power-efficient than general app usage and internet browsing.
by exoverito | 2025-09-10 01:35:17+00:00
It still amazes me that people believe that intelligence has no link to genetics. Down's syndrome is not simply a social construct, Trisomy 21 is a genetic disorder from a third copy of chromosome 21, distorting gene dosages and resulting developmental pathways. Nearly all phenotypes are a mixture of genetics and environment, yet some traits have a much higher degree of heritability. For example, height has a heritability of 60 to 80%, once you control for sufficient nutrition it's almost entirely due to genes.

The most elegant proof of IQ being linked to genetics:

The same person taking an IQ test twice has mean correlation of 0.85 or above in their scores. Identical twins reared together: 0.86 Identical twins reared apart: 0.76 Biological parent and child: 0.42 Adoptive parent and child: 0.19 And of course, any two random people will have a correlation close to 0.

https://en.wikipedia.org/wiki/Heritability_of_IQ#Correlation...

If you do not believe this, then I would have to hypothesize you are succumbing to motivated reasoning out of a deeper value system placing equality above all other values. This is a well known pattern of belief amongst leftists, where they think humans are infinitely malleable blank slates and all inequalities can be rectified given enough social engineering. They deny objective group differences because they want a utopia where everyone is equal. This is clearly unrealistic, but furthermore it contradicts their value of diversity, where if people are diverse, then you would expect variation in all traits, intelligence included.
by behindsight | 2025-09-10 01:36:00+00:00
Interesting questions, I can later provide more links to more indepth security resources that go over similar points if you would be interested but currently on my phone so I will just jot down some quick surface level points.

> If a malicious website reads the clipboard, what good is knowing an arbitrary password with no other information?

Even if assuming unique username+url pairings, clipboard history can store multiple items including emails or usernames which could be linked to any data breach and service (or just shotgunned towards the most popular services). It's not really a "no other information" scenario and you drastically reduce the effort required for an attacker regardless.

> If you're talking about a malicious desktop app running on the same system, it's game over anyway because it can read process memory, read keystrokes, etc.

The app does not have to be overtly malicious, AccuWeather (among others) was caught exfiltrating users' clipboard data for over 4 years to an analytics company who may or may not have gotten compromised. Even if the direct application you are using is non-malicious, you are left hoping wherever your data ends up isn't a giant treasure trove/honeypot waiting to be compromised by attackers.

The same reasoning can be used for pretty much anything really, why protect anything locally since they could just keylog you or intercept requests you make.

In that case it would be safer for everyone to run Qubes OS and stringently check any application added to their system.

In the end it's a balancing act between convenience and security with which striving for absolute perfection ends up being an enemy of good.

> Sidenote: Most password managers I've used automatically clear the clipboard 10-15s after you copy a credential.

That is true, good password managers took these steps precisely to reduce the clipboard attack surface.

Firefox also took steps in 2021 to also limit leaking secrets via the clipboard.
by astrange | 2025-09-10 01:36:43+00:00
It certainly isn't something you can just turn on. I don't know how hardened_malloc works, but one problem is that C malloc() doesn't know the type of memory it's allocating, which is naturally an issue when you need to… allocate typed memory.

You can fix this insofar as you control the compiler and calls to malloc(), which you don't, because third party code may have wrappers around it.
by rifty | 2025-09-10 01:36:47+00:00
The 16e is 167 grams, where the Air is 165 grams. It feels like the Air is to the 16e what the Pro is to the standard titled iPhone — the expensive version.

Which makes the marketing feel a bit incongruent with what we've gotten here. It's not noticeably more lightweight than what is currently offered, it's less featureful than the 17, but more expensive than the 17 (albeit perhaps prettier).

It seems like engineering failed to make a true superlight in its class despite narratively trying to re-evoke what we really did experience with the original MacBook Air. Instead we got an elegant up sized 16e priced like a Pro.
by mk_stjames | 2025-09-10 01:36:49+00:00
One of the most delightful things involving reading HN is seeing a strange, context-less post in the morning, and then, later in the day or evening, coming across another piece of information- maybe a popular article on another website or a very popular youtube video- that then leads you to some research hole, possibly wikipedia'ing and following the older, linked sources- where you wind up on the exact page linked from the random post that morning and it becomes pretty obvious that you just retraced the exact steps that a like-minded individual had done earlier that day.

It's happened to me several times where I doubt it could be simply recency bias coupled with chance of topics, due to the specificity and narrow directed-ness of the graph.
by jrtc27 | 2025-09-10 01:37:15+00:00
That's not true. Capabilities are in main memory as much as any other data. The tags are in separate memory (whether a wider SRAM, DRAM ECC bits, or a separate table off on the side in a fraction of memory that's managed by the memory controller; all three schemes have been implemented and have trade-offs). But this is also true of MTE; you do not want those tags in normal software-visible main memory either, they need to be protected.
by forgotoldacc | 2025-09-10 01:37:56+00:00
I travel internationally pretty often. I also use my phone as a GPS when driving. Both cases have resulted in me having my battery at under 10% and desperately hoping I have enough power to get to where I need to go. And always having a charger or backup battery of some sort is just inconvenient.

For the people who are at home 90% of the time, they're probably not using a phone the whole time. They'd be better served by a desktop.
by kortilla | 2025-09-10 01:37:59+00:00
> I mean, if there is some stay at home parent that finds looking after their own children during the daytime such a burden they "need" an extra $1k per child per month to do it... they should probably just use the free childcare.

The fact that you argue for daycare workers to be paid but not parents is honestly astonishing.

“No, we will not give you $100/day for your kid but we will happily give $100/day to BabyCorp to watch your kid” is a really fucked up policy stance unless you explicitly want to break children apart from their families. If that’s the goal, just explicitly say it.
by johnnyanmac | 2025-09-10 01:38:07+00:00
Hard to say. Different regions will have different "tools" to use. For a large round, it's probably because they need to cut a lot of staff ASAP or because they have the offshoring ready to replace them. Paying them off is best in those situations.

If you need to fine cut a few particular teams then poking it with an RTO is better than giving them a severance package. This is all conjecture, but that's probably what those up top are considering with every move.
by marcus_holmes | 2025-09-10 01:38:13+00:00
LLMs cannot create copyrightable works. Only humans can do that [0]. So LLMs are not making new copyrightable works.

[0] not because we're so amazingly more creative. But because copyright is a legal invention, not something derived from first principles, and has been defined to only apply to human creations. It could be changed to apply to LLM output in the future.
by aero_code | 2025-09-10 01:38:42+00:00
No, ICE did not kill those people. I looked through the latest six this year. Two were suicides (one suicide was of a man who had state charges against him for several crimes including child molestation), one was someone who had diabetes and refused to take insulin, and the others seem to have had other health issues. They got medical care many different times.

I think it is misleading to conflate murder with people dying of health issues in detention after medical care.
by gertop | 2025-09-10 01:39:08+00:00
That kind of fake self-aggrandizement-delusion-driven story telling is part of the autistic trans subculture. That particular subculture tends to speak of themselves as goddesses, wizards, or other higher beings. Their websites are usually dark themed with pastel or neon forecolors and you'll find anime girls inserted every now and then .

As far as I can tell it isn't a joke per se, but it is tongue-in-cheek and the ego is often very real.
by 01HNNWZ0MV43FF | 2025-09-10 01:40:08+00:00
People are real quick to declare things obsolete without thinking about Pareto frontiers.

Tapes and floppies are "obsolete" if you don't have to worry about malicious controllers embedded in flash media or hard drives.

Paper is "obsolete" if you don't have to worry about cost per square inch of displaying static information, or about running without batteries.
by dotnet00 | 2025-09-10 01:41:24+00:00
Most paid software generally makes you acknowledge that you have read and accepted the terms of the license before first use, and includes a clause that continued use of the software constitutes acceptance of the license terms.

In the event that you try to play games to get around that acknowledgement: Courts aren't machines, they can tell that you're acting in bad faith to avoid license restrictions and can punish you appropriately.
by yepitwas | 2025-09-10 01:41:52+00:00
Monopolies are a huge problem in every sector of the economy. Republicans and especially Chicago school folks forced a change in how we enforce antitrust in the ‘70s, such that now we hardly enforce it at all. (The resulting concentration of power was, IMO, the first major step toward the entire gestures broadly at everything we’re dealing with now, but putting that aside, it’s definitely been awful for market health in practically every sector)

Trump’s trade policies his first term drove away foreign buyers, who didn’t rush back afterward. US farmers rely on exports, as we farm way more than we need to to feed just the US. We had to (well, “had to”) bail farmers out then, because of Trump’s trade policies, and now we may well do it again for the same fucking reason.

Wonder who they voted for.
by foobarian | 2025-09-10 01:42:03+00:00
We did something similar with our now 12yo. She self-regulates and tries to stay off the worst doom scrolling garbage sites, and tries to explore different sites and such like Pinterest cards and so on. She knows intellectually that the apps and services are designed to suck away attention. This kinda broke my heart but the other day she made a "bored jar" probably based on a Pinterest card which is a jar filled with little scraps of paper with ideas for what to do when you're bored. It felt like I was watching a drowning person trying their best to stay afloat if that makes sense.
by 01HNNWZ0MV43FF | 2025-09-10 01:42:28+00:00
Who's your host? My primary VPS host and my home connection both block the only port I'm supposed to use for mail.

(A curiosity to me, as someone trained on HTTPS, which doesn't really care what port you're coming from. I wish there was just mail-over-HTTPS, since port 443 can't be blocked by a reasonable host.)
by akerl_ | 2025-09-10 01:43:16+00:00
You've picked a really weird hill to die on here. Coordinated disclosure exists and means what we're describing it to mean: a disclosure where the researcher attempts to reach out to the vendor to remediate prior to publication.

That you've latched on to a specific opinion about what "coordination" means that excludes that behavior doesn't change how the term works in the security field, what it means, or whether or not it's preferable to "responsible disclosure" to describe that set of actions.
by losteric | 2025-09-10 01:43:16+00:00
> Big corpo is a modern feodal state, where CEO is an emperor, c-suites are kings, managers are barons

Why do people forget about board members and shareholders?

There's a lot of overlap among the rich. I doubt Satya "wants" to RTO. I would suspect board members / shareholders with real estate interests are forcing the policy. (eg Vanguard holds 10%, with Blackrock close behind).

Big corpo is a feudal state, in the sense of complex incestuous power dynamics. It's oversimplifying to call CEOs emperors.
by jrtc27 | 2025-09-10 01:43:17+00:00
> has a parallel capability stack

There is one stack, the normal program stack that's normal main memory.

> capability pointers

If you use pure-capability CHERI C/C++ then there is only one type of pointer to manage; they just are implemented as capabilities rather than integers. They're also just extensions of the existing integer registers; much as 64-bit systems extend 32-bit registers, CHERI capability registers extend the integer registers.

> requires microarchitectural support for a tag storage memory

Also true of MTE?

> your memory operations also need to provide a pointer to a capability object stored in the capability store

There is no "capability object stored in the capability store". The capability is just a thing that lives in main memory that you provide as your register operand to the memory instruction. Instead of `ldr x0, [x1]` to load from the address `x1` into `x0`, you do `ldr x0, [c1]` to load from the capability `c1`. But `c1` has all of the capability; there is no indirection. It sounds like you are thinking of classical capability systems that did have that kind of indirection, but an explicit design goal of CHERI is to not do that in order to be much more aligned with contemporary microarchitecture.

> The capability store is literally a separate bus and memory that isn't accessible by programs,

As above, there is no separate bus, and capabilities are not in separate memory. Everything lives in main memory and is accessed using the same bus. The only difference is there are now capability tags being stored alongside that data, with different schemes possible (wider SRAM, DRAM ECC bits, carving out a bit of main memory so the memory controller can store tags there and pretend to the rest of the system that memory itself stores tags). To anything interacting with the memory subsystem, there is one bus, and the tags flow with the data on it.
by zdragnar | 2025-09-10 01:43:45+00:00
Generations of family farms have been selling out over the course of my life due to the bad economics. Dairy farms consolidate, and fields are worth more for building houses on than for growing corn or soy or wheat.

It used to be at least one of the kids would take over the farm, but now as parents age out, there's simply too many better opportunities with less hard effort out there and fewer are interested in staying in the business.
by forgotoldacc | 2025-09-10 01:44:03+00:00
Most planes and trains in Asia don't have chargers. Maybe your country does. Your country is not the norm. Places that do have chargers are swarmed by people with tiny batteries desperately trying to charge up. And those charging spots charge about 1% every 15 minutes.

As someone who's been all around the world and goes places every week, I'd take a battery that lasts all day and charges when I sleep over needing to stop and try to get another 5% of charge wherever I can and constantly being on the lookout for chargers.

Also, people go into nature. We take hikes and walks in the park. It's nice to have a map there. It's also not easy to charge in the middle of the forest. And there are lots of people outside and needing good batteries. Nobody is staying home 90% of the time.
by OneDeuxTriSeiGo | 2025-09-10 01:44:33+00:00
> for example, their recent push to centralize bookmarks.

It's worth noting that the current bookmarks implementation is "temporary" and will be moved to the PDS as soon as private data repos are supported on the PDS.

The approach they are taking (and are recommending to other devs in the space) is "develop your private data as if it was stored on the PDS but stored on the appview. then migrate to the PDS once private data launches". If you maintain the same lexicon/schema under the hood, you can just copy the data to migrate it.

Private data is unfortunately really hard to do right so this "start workshopping it and get ready for us to roll support out" approach seems like the best temporary solution.
by Sherveen | 2025-09-10 01:44:40+00:00
Don't you think it's a little circular that you always default to assuming that their support is about regulatory capture?

Like, what if they had that opinion before they built the company? If you saw evidence of that (as is the case with Anthropic), would that convince you to reconsider your judgement? Surely, you think... some people support regulatory frameworks, some amount of the time... and unless they banned themselves from every related industry, those might be regulatory frameworks that they might one day become subject to?
by sdsd | 2025-09-10 01:44:50+00:00
This is an empirical claim and there's statistics already available. Almost every study of student performance dramatically favors homeschool over American public school. I'm not saying this in support of homeschool, but as an indictment of public school. It's wild that schools spend many millions of dollars on hundreds of professionals, materials, and centuries of institutional knowledge, and yet are trivially outcompeted by just a mom who puts in the hours with a curriculum from the internet.