skysight-inc/HackerNews huggingface dataset:
As a matter of routine, nobody with a clue would ever allow public Internet connectivity to the BMC NIC. They would also never allow the "bridge" mode where the BMC NIC gets logically connected to one of the primary NICs (useful if you want to spin up a box with only one drop cable in the lab). I wondered if perhaps the attack involved subverting the air gap between the BMC NIC and a primary NIC. Perhaps a reason to use https://en.wikipedia.org/wiki/IEEE_802.1X
Think about how you learned a spoken language and when you were able to spend time articulating ideas instead of thinking about words and grammar for it. That's kinda how mastering a music instrument is like.

Basically the first few years of anything (music or not) seems to be about correct articulation/grammar/vocabulary, and beyond that it's about the quality of expression.

(former classically trained concert violinist of 10+ years, hobbyist latin dancer of 10+ years - swapped a musical instrument for a physical one as an optimization to go along with long periods of desk work)
I wouldn't guarantee that. Depends on whether it's automated or manual.
Bay Area, CA
Here is the paper describing the lazy thread spawning implementation: https://ece.umd.edu/~barua/ppopp164.pdf
I didn't think it was all that obvious, and after I read the OP's answers I thought he was complaining about distributable size, instead of deployment procedures.
You should give Hubs a try, it's a WebVR based collaboration and communication tool we're working on at Mozilla. Screen sharing is behind a feature flag (and not quite working atm) but you can bring in GLTF models, images, and do simple 3d drawing. Also, by being the browser, it avoids a lot of the installation and coordination steps of native apps, and works on phone and PC.

https://hubs.mozilla.com
I thought the article was implying the attack involves the BMC's capability to supply (or change) a boot image. However I'm not sure how that would be able to defeat boot image signing and storage encryption.
To my knowledge, there are still no tasks a D-Wave is better at (asymptotically) than a classical machine
> there’s of course never going to be reported in the US what we are doing

That doesn't square with all the reports on US domestic and international spying, much of it in the NY Times, not to mention The Intercept and others. How do you think we know about it? Not from Chinese and Russian newspapers.

> We’re seeing a lot of anti Chinese and anti Russian news

Hmmm ... maybe we're seeing a lot of Chinese and Russian activity. If you look at coverage of the current US President, you might notice a lot of 'anti-US' news also. Under the prior administration, there was a lot of that on Fox News and in the Wall Street Journal.
The nice thing that the uncertainty of what they do can be resolved now.
I'm always surprised that PostgREST isn't the industry standard for creating an API. It looks like it would save so much work and the corner cases can be handled without writing code in a different language.

What am I missing?
I disagree. California rules tomatoes outdoors...processing, heirloom and cherries. We have the perfect climate and soil for it. Hands down, outdoors is way more efficient and prodctive than anything with indoor tech.
Yes, in fact, because it's generally calibrated to the whole human population and is defined on an assumed bell curve, the differences in scores in the outliers are somewhat meaningless
It makes an empirical claim using empirical data. Empirical data is complicated and inherently probabilistic. The fact that empirical studies sometimes conclude things that are wrong does not invalidate the notion of empirical investigation. It is an expected part of the distribution. It is also an issue that sometimes research practitioners do not follow the best practices, and this can lead to an exaggeration of false positive results beyond what you would expect from the underlying statistics. However, this also does not invalidate the idea of empirical investigation. It simply means we need to iterate on our training techniques and peer review.

What this paper asserts is not that gender studies need to iterate on their techniques. It does not assert that the basic methodology of gender studies is good, but it needs some tweaks here and there. It asserts that, at a fundamental level, the concept of the field is flawed. They assert that the entire methodological framework is flawed. No one, not the authors of the replication crisis paper, or Ioannidis, nor any other serious academic asserts this about math, physics, etc...
Do you have any evidence? Otherwise the comment is no better than another kind of op.
I think it's cool your tackling this space. I would love an open source system that supported my Control 4 hardware. Having to swap out hardware is a deal breaker for me.
I do this all the time with BlueJeans. If you mute your speaker and mic, the other party doesn’t even easily know you’ve joined.

Most of the times, random codes failed but once I managed to accidentally dial in into a Facebook meeting.

Fun times!
I'm giddy to read this paper in full. These claims are nuts...
The article is interesting. We replaced the baity title with representative language from the text. Hopefully that will spare us all yet another boring flamewar about the c-word.

If anyone can suggest a more accurate and neutral title, we can change it again.

Edit: ok, you guys didn't like "When analysts are replaced with index funds, the market stops allocating capital", so I dug up another representative sentence from the article.

The best way to complain about a title is to offer a better one, so if you don't like this one either, maybe take a crack at it?
A Review of Rams, Gary Hustwit's New Documentary about Dieter Rams
It's equally important to question your "team".

In the developed world, hatred is often manufactured to gain power... The leaders of a nation can cause more harm in their quest for glory than the average citizen of an opposing state.
Some developers love them, but as a developer myself the idea that I need apples permissions to run my own apps on my own machine makes my skin crawl.

If early computing was a walled garden environment like iOS I never would have been a developer.
Human Equivalent Dosage
Can someone flag this garbage?
I started playing the piano around 4 but gave up around 12. I can play by ear pretty easily, meaning listening to a song and just play the main rhythm. It always feels natural to me, so I guess I didn't feel anything special about it. It wasn't until much later did I realize not everybody can do it.

An interesting side effect of this, is that whenever I hear a piece of music, I can correlate the notes to the keys on the piano, such that next time I sing that song, it can start at the exact same pitch. (Just looked it up and it's called "Absolute pitch"[0])

0: https://en.wikipedia.org/wiki/Absolute_pitch
More absurd false equivalence.

Simply treating a customer the same as other customers is not equivalent to actively providing resources to a political cause.

And yes, payment processors do owe it to customers to treat them equally with regards to their politics and beliefs (as well as their race, gender, language, and so on).

You seem to want to live in a world where wrongthinkers are viciously persecuted by every person, every business, everyone in every possible way. Because you think you'll always be in the team with the power to do that. When you have the experience of being the hated minority, you'll understand the value of equal treatment and the norms of individual freedom.
Of course it can. The methods it can do so legally are limited, and it has no "free floating" power to do so, but that doesn't mean much.
React Authentication with Twitter, Google, Facebook and GitHub
Disappointed that there was not any actual technical substance to this article aside from the pictures of the boards. I was excited for a moment, hoping they'd get further until the details, but it ended up in some opinionated rant about how the SEC should get involved.
They use a bunch of energy because we can trade power for speed, and entropy is completely irrelevant at 0% of the budget.
Surprisingly no references to Saber.

I'm somewhat disappointed
People have recieved spam extortion emails in the past week containing passwords
Compound | Sr. Engineer | San Francisco (no remote)
Compound your Crypto. Compound is an open-source protocol for algorithmic, efficient Money Markets on the Ethereum blockchain. We are looking for an experienced engineer to join our team of 4 engineers (includes our CTO). Lots of tough work to take on as well as fun to be had. https://compound.finance/ If you are interested or just curious I'd love to tell you more - emily@compound.fiance
Vehicle registration?
Well, why did not they just use C#? It already had most, maybe even all of Go's current features.

Hell, the main thing of Go, the go op is basically await.
In the other threads it has been mentioned that this hypothetical attack could run similarly to the US/Xerox op in the Cold War. The Xerox machines recorded data which was collected by a Xerox technician during regular maintenance. A board with a trojan chip on it could potentially record data to be collected during an RMA. No need for network transmission.
For me, it suddenly clicked after a decade or so. The same thing happened with improvisation and keeping excellent time. I felt like I was always struggling until one day whatever I heard in my head came out my fingers.

It's just that the process is very gradual and takes a long time. I suppose the 10k hour rule applies here.
Pinguis definitely has solid fat connotations for me.
2 Men Rejected NBA's $3M Offer. That Decision Made Them $800M
This is crazy
ahmen
If the rogue firmware was indeed loaded from this chip, the "bridge mode" could have been forcefully activated.
Every time I see people saying stuff like that I remember of this:

http://james-iry.blogspot.com/2009/05/brief-incomplete-and-m...

> His lambda calculus is ignored because it is insufficiently C-like. This criticism occurs in spite of the fact that C has not yet been invented.

Anyway, it's not because C-like languages are any easier. It's just that nearly all programmers learn to code in a C-like language. Most of them won't ever learn a second language, the number that will do the work of learning something actually different is minuscule.
The article did mention something around the lines of "the compromised machines could talk to other compromised machines on a network" so I guess the idea is to find a compromised machine close enough to an edge network to reach a C&C server?
I bought the book in beta, chapters 1 - 14 are complete, the last 3 chapters are in progress. More than enough material to keep you busy until the author finishes the last 3 chapters.
I've read some about Esterelle, but no other contact. Had anyone had any experience with any of these?

One of my professors had an idea about distributed synchronous programming, but nothing ever came of it.
Impressive.

But am I wrong to have my hackles raised by a) the roll-your-own security nature of this, b) the reliance on a single developer's single stack implementation as what guarantees the integrity of the system? It seems like there are a lot of assumptions baked in.

I, too, would love to see a more detailed write-up--if there's a big idea here (almost a unikernel thought), it deserves to be shared and tried by fire.
But monitoring software really wouldn't detect this...?
A hedge fund manager told me the whole investment industry is a net cost of 1-2% of global GDP per annum. I don't specifically what study that number came from, but if true its likely one of the main reasoms many see it as a waste.
That depends on how you fold a website. ;-)
All very true. Just focus on the basics, stay in your lane, and eventually your company will win. It's a tough balancing act.
Blazor 0.6.0 experimental release now available
I would really love to hear why performance specs you mention are still necessary for robotics applications. Repeatability and speed certainly seem useful industrial robotics applications, but low cost also seems critical to enabling broader use of robots. I am particularly interested in the possibility that modern algorithms (e.g. deep reinforcement learning) can compensate for not having completely repeatable behaviors from a robot by using sensory feedback to create behaviors that reliable despite their variability. Additionally, materials with higher elasticity (e.g. plastics instead of metal) might allow some previous impossible efficiencies, e.g. by storing potential energy in the links and then releasing it at the right time. Is it just too soon for these sorts of approaches?
Ask HN: How much can you multi-task?
I always wanted to do multiple things at the same time, to be more efficient in life. Simple examples include: listening to podcasts while driving, cooking, etc. But the list is pretty limited and I can't do much more beyond that.

The question is, what can a typical person achieve? What are some multi-tasking opportunities that you take advantage of?
Wouldn't state actors be able to steal the software used by Apple to re-enable the software? With a network of thousands of "Apple Authorized Service Providers" there's gotta be leaks (that is, if state actors didn't have access to Apple's own internal systems).
This article brings up a point I used to worry about - if people are just automatically pumping money into a list of stocks, how does the price remain connected to reality?. But apparently the answer is that mis-priced stocks present an arbitrage opportunity (https://www.investopedia.com/terms/i/indexarbitrage.asp), so as long as a few people are paying attention, the price remains rational, and the remaining people paying attention are rewarded for doing so. The Economist had an article about this issue recently and they concluded that the main effect of Index Funds was to drive low-performance fund managers out of business.
What you're describing sounds like another backdoor of its own!

The general problem with most "industry security" approaches is that they simplistically attempt to wrestle ultimate Godmode-control for themselves, rather than working towards eliminating it.
They do have culture (and philosophys are part of the culture) and this is really what people perceive as its soul. And the culture can change.
But this could easily break down for outliers while still maintaining the general trend
Oh, you mean the bottleneck was on some processing you were doing before sending it to the database? That's cool.

It was mostly on a low-end laptop with integrated graphics lol. I was more interested in learning how parallel algorithms work than anything. Now I feel like an idiot.
I think this might be the "hackernews effect". As you go checking and reading HN content, they get less and less esoteric until you start think it became too mainstream.
Thanks - that's a very interesting way to look at it!
It's possible that some servers hang the BIOS flash off the BMC, or (more likely) at least have some way for the BMC to write to it - if not by design, then through a HW vuln further up the stack.

And I believe that once you control the BIOS image you control the boot chain of trust.
Common mistakes people make while choosing a computer repairer
If you don't like the particularities of how with how a business does business, don't buy their products. If enough people agree with you, the company will either go out of business, or will change its business practices.

The what amounts to hand wringing over Apple, mostly gets people flustered, without actually changing anything, but perhaps the direction of a few electrons somewhere.
https://devcenter.heroku.com/articles/heroku-button is pretty good if you can "Heroku-ize" the product. Easy installation, updates, scaling for sure.
Im pretty sure d wave never claimed to be able to run Shor's algorithm either
This breaks the site guideline that asks you not to insinuate astroturfing or shillage without evidence. Please don't do that—it's a toxic trope that leads to dumber threads.

https://news.ycombinator.com/newsguidelines.html

Edit: looks like we've already warned you about this more than once. If you keep doing it we're going to have to ban you, so please don't post like this again. Ditto for unsubstantive comments in general.
I've not looked at the details but maybe they should have make the lock optional to the user. Initially it is unlocked but once enabled, it cannot be disabled. This will give the right level of flexibility.
True, but when such papers are discovered, they're usually torn down by people in the field. In this case, it was the other way around - all meaningful criticism came from the outside, and in response, researchers in the field mostly circled the wagons.

Besides, the paper in question wasn't merely published - the author got a prestigious NSF award that lists that paper:

https://www.nsf.gov/awardsearch/showAward?AWD_ID=1253779

This, to me, implies that either such papers are considered broadly acceptable in the field, or they're not actually read. Not sure which is worse.
Passing the "wrong" number of arguments isn't a syntax error in JavaScript.

If you pass fewer arguments than declared parameters, the rest are implicitly undefined. The variations you were seeing probably just came down to how the invoked function handled that undefined value. I can still understand how inconsistency in behavior there might be confusing.
When you lose a house key it's pretty manageable to get a few locks changed, but it can be rather overwhelming to remember all the dozens of websites that have your auth details, and update them.
So far the pace seems to be about two chapters a month, with the update today bringing the total up to 14. According to the TOC, that only leaves three more to go, plus revision and editing. It is being released in-order - following the author's twitter and screenshots posted there over the past two years, it looks like the content is complete.
Humans don't either =)
The answer, as I see it, to this, is transparent decryption via federated ledgers. That way the data is not just "available".

Note- the big guys (facebook, google) could trick/force individuals into handing over keys, but if you make the keys per object this becomes less effective for the same big guys.

In a sense, there is no control without encryption.

Still cogitating the various hows, but transparency to the user is the key.
Neither is concurrency. But if you need concurrency, functional is very visibly the way to go.
Nationalistic slurs will get you banned here. Please don't stoop to that again.

https://news.ycombinator.com/newsguidelines.html
Basically, yes. Deep RL has the potential to make high accuracy/repeatability unnecessary, but it's still in the research lab setting.
Only works in some roads, and requires you full attention the whole time. Somehow that makes it better. By this logic a car with manual only mode is even better.
Ok, given that they approached you, and based on the per project prices suggested in that link, it could've been around $2.5k and up.
There aren't that many people in the world that could build and use a Tamarin model for a crypto protocol, let alone prove it formally. Proof-driven cryptographic engineering is even more specialized than standard cryptographic engineering.
You probably wouldn't! Aumasson isn't arguing in favor of closed-source cryptography. He's just dispelling a particular myth about the security differences between the two types.
So publicly criticizing the business practice you don't like, as a gambit to get other people to agree with you, is just off the table?
Nationalistic flamewar is not welcome here; neither are political or ideological flamewar. We ban accounts that use HN primarily for those things. Please read https://news.ycombinator.com/newsguidelines.html and follow the rules when posting here.
I used to think so but it's much closer than you think.

My side project we're using a Prusa Mk3 for an end use part and the quality and cost is amazing. A lot of other people are doing the same. There are so many types of material too now.
Musk versus Bezos: How two billionaires battled it out for the space race
The number of users who simply want/need cheaper repairs and upgrades dwarfs those who are at risk of getting their hardware bugged by state-sponsored actors. And considering these laptops are made in China in the first place, any assurances of security are already moot.

If security was the primary concern, Apple would sell this as a separate model variant (manufactured in the USA) and charge a lot more for it.
PostgraphQL
I simply can't decipher this comment
Y Combinator Is Hiring a Batch Director
Y Combinator is hiring a Batch Director. This role reports to the CEO and works directly with partners, founders, and YC employees to execute and improve the batch. There are few job that give you this level of insight into YC and this level of interaction with the 300 companies that participate in YC every year.

Apply here: https://jobs.lever.co/ycombinator/b5489fe2-b163-4abf-b91c-551b691e6ed6

—

Batch Director's Goals

Make YC programming operate efficiently; deliver maximum value in minimum time

Collect feedback and iterate on the YC program over time

Execute and manage the YC batch event schedule

Create an environment in which all founders thrive

Make sure Demo Day is delivering maximum value

Understand and help build out the programming and community for YC alumni

Interact with all of the teams at YC that interact with founders; provide feedback on the founder experience and how teams’ work can be improved

Be seen by founders as someone to talk to about things they might not be comfortable talking about with YC partners; be a friendly ear and thoughtfully advocate to improve the founder experience when necessary

Understand and improve YC’s process of teaching. Improve the transfer of information to founders

Streamline the immigration process for international founders

—

Requirements

Possesses extremely strong communication skills - both written and verbal
Ability to work gracefully among a diversity of strong personalities
Ability to work nights and weekends as needed in SF and Mountain View
(2+ nights per week 7 months a year)
Ability to create and manage a budget
Ability to juggle many high-level responsibilities without losing sight of the details
Ability to thrive when personally responsible for both strategic and
time consuming/mundane work

We’re proud to offer a set of benefits that few companies of our size
can, and they’re selected to help you be productive and feel taken
care of as much as possible. In addition to top quality healthcare
benefits, offerings include: 401k matching, generous parental leave,
commuter benefits, catered lunch, and a flexible vacation policy. We
also offer competitive compensation, including equity in YC's
portfolio.
My point is precisely that there were numerous violently suppressed socialist revolutions in Europe, on a scale far greater than anything that had ever happened in the USA:

https://en.wikipedia.org/wiki/Revolutions_of_1917%E2%80%9319...

Any government is going to violently suppress a revolution (or cease to exist immediately). The difference is that there wasn't even an attempt at a socialist revolution in US. The labor movement here was mostly focused on labor rights, not on the broader politics of class struggle. Radical socialists and communists within the movement were never numerous enough to organize a revolution.
Ask HN: What are some great retro computing projects to contribute to?
Kind of sad to see them shut down. Been following them since the Baxter robot came out. Unfortunately, the current market just does not have a high demand for highly flexible robots. Most of the fully automated lines are highly specialized lines. Company invest hundreds of millions, with the expectation of maintaining the line for years. It's usually simpler and cheaper to use standard actuators with multiple stations rather than a complex robotic arm. However, the couple of applications from Universal Robotics and Kuka is pretty cool to see.