skysight-inc/HackerNews huggingface dataset:
The reason Bloomberg is so sure about this is because chips/'infected' Supermicro boards were originally found at Bloomberg. They noticed odd web traffic coming from a server, took a look, found nothing, looked closer, and finally found a hardware exploit.

What you're seeing in the Bloomberg piece is a bunch of half-truths backed by soild data. It is a BMC exploit, and they are doing it through the BMC EPROM, and even the position of the 'exploit' in the article's graphics is accurate. This is obfuscated because of an ongoing investigation. It's real, but there's purposeful misinformation, combined with a journalistic game of telephone or chinese whispers.

It's also about the worst possible way to drop and 0-day, but whatever.
JIRA makes it dangerously easy to implement overly bureaucratic processes. A certain kind of organization is drawn to it for that reason. Even a healthy organization switching to JIRA can get carried away with the tools now at its disposal.

JIRA is a software product but also a social institution, an organizational philosophy. Sure, you can have the software without the attitude or vice versa, but use of JIRA is still a (weak) negative signal about the quality of an employer.

Turns out that the main thing protecting employee autonomy is the logistical difficulty of micromanagement. JIRA "solves" that problem.
HN limits reply depth, so i'll reply here:

> If you presuppose that the category is absurd, the submission of an absurd paper is a vacuous act that proves nothing, and your point should be able to be easily demonstrated by your knowledge of the field as it stands.

It is my opinion and the thesis of the paper, that the papers that they got accepted to these journals is absurd. I will quote here the theses description of the 7 accepted papers:

Sure, most got rejected. But 7 got accepted. And while banality is obviously a subjective value judgment, I don't think it applies to all of them. Just to enumerate the hypotheses that were accepted:

> That dog parks are rape-condoning spaces and a place of rampant canine rape culture and systemic oppression against “the oppressed dog” through which human attitudes to both problems can be measured. This provides insight into training men out of the sexual violence and bigotry to which they are prone.

> That it is only oppressive cultural norms which make society regard the building of muscle rather than fat admirable and that bodybuilding and activism on behalf of the fat could be benefited by including fat bodies displayed in non-competitive ways.

> That it is suspicious that men rarely anally self-penetrate using sex toys, and that this is probably due to fear of being thought homosexual (“homohysteria”) and bigotry against trans people (transphobia). (It combines these ideas into a novel concept “transhysteria,” which was suggested by one of the paper’s peer reviewers.) Encouraging them to engage in receptive penetrative anal eroticism will decrease transphobia and increase feminist values.

> That men frequent “breasturants” like Hooters because they are nostalgic for patriarchal dominance and enjoy being able to order attractive women around. The environment that breastaurants provide for facilitating this encourages men to identify sexual objectification and sexual conquest, along with masculine toughness and male dominance, with “authentic masculinity.” The data are clearly nonsense and conclusions drawn from it are unwarranted by it. (NB. One reviewer did raise concerns about the rigor of the data)

> That academic hoaxes or other forms of satirical or ironic critique of social justice scholarship are unethical, characterized by ignorance and rooted in a desire to preserve privilege.

> No clear thesis. A rambling poetic monologue of a bitter, divorced feminist, much of which was produced by a teenage angst poetry generator before being edited into something slightly more “realistic” which is then interspersed with self-indulgent autoethnographical reflections on female sexuality and spirituality written entirely in slightly under six hours.

> That feminism which foregrounds individual choice and responsibility and female agency and strength can be countered by a feminism which unifies in solidarity around the victimhood of the most marginalized women in society.

I'll grant you that two of them, the 'breasturants' and Mein Kampf are relatively mild on the absurdity scale. The rest, in my view, are self-evidently ridiculous and/or unethical. If you disagree, feel free to explain why.
Because they don't care, what they're doing is good enough and at the end of the day they want to go home and enjoy what they like together with the loved ones. Shocking, truly :p

I know this is a dirty thought, here on Hacker News.
English used to have more of these handy characters (like þ) but sadly the language is being denuded and stripped. Even the subjunctive form is almost dead - most of the time it's "I wish I were there", not "I wish I was there", dammit!
Patrick Kennedy missed the point of the Bloomberg article, there. Bloomberg pointed out that the qualitative difference is that this is not an exploit of some existing BMC firmware vulnerability. It is the sly introduction of subverted hardware at the point of manufacture and the corruption of the supply chain. It's not the BMC that is the locus of the vulnerability, but the supply chain itself. People had hypothesized this over the years. The Bloomberg report points out that it is a threat model that people seemed unwilling to pay attention to for economic and political reasons. That report, if true, is tantamount to "Yes, you were right about the threat; and this is not a hypothetical any more. China actually did it some years ago.".
> There was a growing understanding from those in microgeneration (under 50KW) that mass scale adoption would only be possible with small units which are less efficient but also easier to access and fix. This is the successful model in germany.

The successful model in Germany is building 4 MW turbines wherever we can fit them (or wherever "landscape protectors" will allow us to put them).
This has very little if anything to do with security, it's about control and profit.

Apple makes good profit with apple store repairs and wants to prevent repairs from happening outside their grasp to make more profit.

Security is designed against a threat model, the vast majority of user do not have to defend against "malevolent third party repair shop planting hacked hardware during repairs". The main culprit for this kind of attack is US governement agencies engaging in interdiction (intercepting hardware during shipping to alter it) not third party repair shops (and IIRC apple works with those US agencies).
https://dzone.com/articles/do-you-really-know-cors
“For someone not blinded by unwavering loyalty you sure do love being locked in to a single vendor.”

That’ll be a logical fallacy whose name I can’t be arsed finding.

I sure do love not having to deal with a bunch of shit just to keep my computers (phones, tablets, watches, earphones, tv) running. That’s what I love.

This sad trope of the Apple fanboy needs to die. Just because I love not having to deal with all the crap does not mean that I love Apple to the depths of my heart. Would I prefer it if they didn’t lock independent repairers out of their new MacBooks? Sure! (Well “probably”, I haven’t considered all of the security implications. But probably!)

Does that mean I’ll stick by them, no matter, what, for eternity? Of course not. If they start to fuck things up, I’ll look for something better.

The point is, right now, there is nothing better. Don’t lie to me and tell me that Linux on a Dell is better. It is not. It is different in some ways, some of which may be important enough to you such that you classify it as “better”. But, objectively, for the everyman, is the Apple ecosystem currently the best? It absolutely is. Does that make me a sad fanboy? Shame on you if you think so.
This also illustrates why hardware implants do not work as a mass infiltration tool. The idea is not getting caught, otherwise risking the whole operation. Implementing a threat like this is counterproductive.
Do you have a source for the Norwegians?
If you're looking for a similar from scratch tutorial in Java, check this one out: https://smalldata.tech/blog/2016/05/03/building-a-simple-neu...
They note in the article that the chip is of the same color and scale as a signal conditioning coupler.
I believe this should have been in response to its sibling. The set theorist in me agrees - the two operations are working on 2 different sets at 2 different levels of abstraction.
Why would Apple and Amazon release such vehement denials, though? If it were an ongoing investigation, wouldn't they use more hedging and obfuscatory language? They could just as easily say "we're not aware of anything like this, but we take all allegations of this nature seriously and are looking into it". The whole situation is just odd.
Feels like VHDL, with different clock domains
Thanks for the question!

It sounds like you have easy access to VR HMDs, so if you get a chance to plug into an Oculus rift any time soon I recommend you try it out - and would definitely love your hands on feedback.

We've done a fair bit of jiggering to make sure a majority of web based content is both legible and usable - and our UI has been built to try to be as intuitive as possible, and eliminate a lot of the bumbles that we too associate with many VR experiences.

It's a free download, and you don't have to create an account if you don't like - once you download, you'll be presented with an account sign up / log in form where the keyboard can be used and messed with a bit. We also use chromium for all of our login / account creation flow in VR - so you can get a taste of what that feels like as well. If you want to try something like Trello out, just create a throwaway account and never verify the email - then you can pull up a website like Trello or NYT, where you can assess the usability and legibility.

I think that if you're coming from a place of comparing this to existing 2D based collab tools like Skype / Zoom etc you'll have a hard time seeing the benefit, but if instead you try to look at how those tools are insufficient compared to a real-life meeting you might see where we fit. Our goal is not to replace 2D based methods, but to allow for a level of presence previously only possible with in-person interactions. This shines in particular in situations where you're meeting with three or more people along with content at the core of the meeting.

Hope you get a chance to try it, and would love to hear what you think and how we can make it better!
As a MacBook owner MacOS feels like abandonware to me.

When I reboot into Bootcamp and Windows 10 I feel like I'm using a machine 10 years in the future.
The key is ,,inside chips''. There's no reason to do those bad things on the die using an extra chip, as it's too easy to prove.
This is a step backward on ownership but the average Joe isn't going to care about this. If at most might protest at their large repair bill they get after dropping their Starbuck's Frappucino over their keyboard.
However they will quickly go back to their normal way of life; which is accepting onerous Terms and Conditions from corporations.
It's a tool that marks the sign that a company cares more about the management of staff as units, instead of caring about employees as breathing and creative forces

That's almost too easy to counter, having worked at a startup with just 3 employees, all devs, and no typical managment whatsoever. Jira was and after like 10 years still is, the go-to tool for bug tracking and it does the job just fine, after a one-time and somewhat lengthy setup phase. Which is obviously nothing compared with the years of use..
My experience is that about 75% of people owning an apple product would like to have serviced/repaired outside apple due to very long delay and overcharged prices.
At this point it'll be hard to make a compelling argument this is all smoke and no fire. The news has been picked up by national news media.
Spinning custom silicon is not beyond the capability of a nation-state.
Kierkegaard on Escaping the Cult of Busyness
Leaving an IPFS gateway open seems as intelligent as running a Tor exit node.
Regarding your first point, I’m trying to imagine what that would look like. So you mean something you could put on there to say (join x [1:1] on blah)? In general the mistake that’s easiest to make is to get duplicate rows from another join later, which this wouldn’t help with - but maybe I’m misunderstanding.
But I'm not prepared to have Candy Crush adverts in my Start Menu, which counts Windows out.

Additionally, I know I can deactivate them by jumping through a couple of hoops, but that's not the point.
> favorable flight direction regarding the earth's rotation.

is the rotation a direct factor or are you referring to high altitude winds?
Push the comparison further, maybe you can apply an aftermarket firmware with less junk, more fixes and latest updates to your device (if you chose it wisely) you cannot do so with an apple device.
Yes, sorry, agree. On stealthness, the article mentioned that “In one case, the malicious chips were thin enough that they’d been embedded between the layers of fiberglass onto which the other components were attached” but also says that the chips came in different sizes so some could have been easier to detect.
I wonder how visa availability affected travel time in 1914 and 2015. I know that I'd like to travel in Europe, but getting visa is very burdensome and unreliable, so I'm just traveling elsewhere. World where you could ride anywhere and settle there without any paperwork sounds like a miracle we lost.
My Bulgarian MacBook adventure was actually pretty great. I needed an arrow key for my 2014 MacBook and contacted a shop in Sofia. They were happy to ship (they had it in sock) it to their sister shop in Varna (closer to me) and once I got there the key and labor to replace it (granted, it only took them 3 minutes) was less than €2.

Yes, two Euros.
Early on we actually built out support for leap motion in dream, and this was super cool because of the networking stack we built - we were able to send all 20 points per hand in real time at 90 FPS at low latencies. This was really an amazing experience, but there were a lot of issues we simply couldn't overcome - like wrist occlusion where your hands would suddenly fly off into the distance, or when your hands didn't do what you intended due to incorrect data from the sensors. As a product minded company, we had to make the hard decision to hold on this - at the end of the day, users don't care whose fault a bad experience is, they just uninstall your app and never come back.

Really excited for new HW and capabilities to become available commercially. We built out our keyboard to be effective without anything but what's currently available (6DOF HMD with 6DOF controllers), and we'll continue to expand support for commercially available capabilities. Maybe it's an unorthodox perspective, but we really only want to ship and represent capabilities that any user can attain easily - and not tease things that are soon to (but may not ever) come.
The RAM is soldered on.
Here you go, it's close to the bottom: https://www.vg.no/nyheter/i/xRkLep/storavis-hevder-kina-inst...

It's from a quote by the head of communications at NSM.
This is how we wish it would work, but in the real world marketing, advertising, neuromarketing and piles of money are here to ensure it does not.

Actually there is this quote, forgot by whom, saying that 20th century saw a shift of power from politicians towards corporation, the largest advance in democracy, and corporation using their newly acquired power to protect themselves from the advance in democracy.
Obviously to quiet their contractor and client fears. Shareholders know that replacing the hardware would be a major cost and PR damage intense.
The WiFi adapter restrictions are either the result of hardware restrictions (the UEFI firmware not allowing a different device) or a lack of drivers (there's no macs with Intel PCI WiFi cards so Intel doesn't have any MacOS drivers).

Although there's plenty of reasons to critisise MacOS restrictions, the WiFi hardware issue is not one of Apple's faults.
> I think it's fair to say that neither JavaScript

Ah yes, how could I forget Javascript :)

> The fact that languages like Python, C#, and C++ use async/await terminology shows how they put the cart before the horse

Of these, I'm very familiar with C# (15+ years' experience). C# had great threading constructs long before it added async/await, and still does. It actually provides a great variety of threading constructs - you can go low level with mutexes, wait handles, and threads; then there's the Task.Run abstraction, Parallel.ForEach, the TPL...

When async/await in C# was first announced, it was hailed as making concurrency much simpler for devs, but I've always found threads much simpler to reason about and debug, while async/await gives you a variety of footguns that can be difficult to debug.

FWIW, I've been using async/await in C# for years now, but coming from much more of a threading background, I confess it's only now beginning to feel intuitive. I dunno, maybe if new devs come to concurrency from the async perspective first, it's easier to grok.
Programmers are not car mechanics that are brought cars. They are car mechanics that are brought anything from an oil tanker to a chimpanzee to fix up.
From 2016:
Report: Apple designing its own servers to avoid snooping
Apple suspects that servers are intercepted and modified during shipping.

"Apple has long suspected that servers it ordered from the traditional supply chain were intercepted during shipping, with additional chips and firmware added to them by unknown third parties in order to make them vulnerable to infiltration, according to a person familiar with the matter," the report said. "At one point, Apple even assigned people to take photographs of motherboards and annotate the function of each chip, explaining why it was supposed to be there. Building its own servers with motherboards it designed would be the most surefire way for Apple to prevent unauthorized snooping via extra chips."
https://arstechnica.com/information-technology/2016/03/repor...
The only driving force for the popularity of passive investing is the bull market of the past 10 years.

It will be significantly less popular when we hit the next recession.
Mozilla talks a lot and don't do much in this direction, they promised Tor integration like 4-5 years ago and all they did is setup 3 middle-nodes.

Brave Browser already has Tor integration in private tabs and working IPFS integration on -dev channel since beginning of this year https://github.com/brave/brave-browser/issues/819
Thanks for the reply. Incidentally I've also worked on a bunch of problems you guys must have had related to the UX in VR. For example I've also implemented a bunch of virtual keyboards ;-)

Are you using straight CEF or have you improved the compositor to composit directly into a texture? IIRC CEF only provides the composited web page in a bitmap and then you're going to have to do repeated texture uploads which is going to be a drag.

Does this support VIVE too or only Oculus?
How is it just status when Apple is the only vendor providing a device that just works with the least time spent fixing it or updating it or removing all the malware that came pre installed on it?

My grandparents and uncles and aunts aren’t looking for status. They want to open their device, press FaceTime and see their grand kids. They don’t want to spend time fighting out which login to use on which service Google is experimenting with (duo/allo/hangout?). Hell I don’t even know.

It’s not status when you they buy windows laptops for 10 years and they have a 50/50 shot of the sleep function working when they close the lid, but they see people with MacBooks just closing the lid and moving on. And never getting a blue screen. And never waiting for Windows updates to finish.

There is a reason Apple has its reputation, and obviously since no one else an offer the seamless experience, they’re going to charge extra for it. But the amount of hours of life it has saved me is worth every penny. That’s how bad the Windows experience was for me and pretty much everyone I know.
When I was a kid in Britain in the 70s "Outer Mongolia" was slang for "the furthest corner of the Earth", and there it is one of the places with the longest travel time from Britain a few generations before. it's interesting how slang and preconceptions get fossilised in children's vernacular.

My wife is from the Chinese regions of Inner Mongolia, which I didn't even know existed until I met her. It looks like her hometown would actually have been harder to reach than Mongolia itself!
I don't think its a dirty thought; its a different perspective. But I do suspect that one of the qualities of a good hacker is to be relentlessly curious about how things work, to set up something and then be curious about how it works "under the hood", and to dedicate some serious time to learning it. Inevitably, that has an effect on relationships and general life.
Their reputations could take a huge hit from this story alone, so a strong denial is the first defense. If they are unaware of any investigation, as they claim, then that makes even more sense.
My guess is Gag order for the US govt.
You're right. It isn't beyond it. But to do this you need access to the binaries and build process to do a differential analysis for injection. If you had access to that why would you not modify at firmware load time?

I can't see any logic in leaving a physical device on the board as evidence. It's like leaving a machete with your fingerprints all over it when you murder someone.
I think the article title is somewhat misleading. What they might found is not "part of the brain responsible for free will" but, rather, parts responsible for perception of volition will and agency.

Those are rather different things. The "free will" thing being a whole tougher nut to crack and, frankly, maybe even pointless to pursue at this stage of neuroscience development.

However, quest for neural correlates of volition and agency is extremely useful and better understanding could help managing catastrophic injuries.
Why would anyone use ubuntu is beyond me, this distro is so bugged and requires so much maintenance.

Try something like manjaro, arch linux, debian, etc.
It’s great software too. People don’t want to save $500 and spend 100 hours dealing with blue screens, uninstalling malware, updating OSs, learning half of a new interface (what is wrong with the Windows control panel team)?
But why would anyone do this knowing that at some point they were practically guaranteed to get caught?
It doesn’t.
I think it's less a sign of how bad JIRA is, and more how bad project management and project managers are in software development.

JIRA can be a decent tool. The issue is the way that 90% of all businesses big and small use it, is just so that managers can shrug off any responsibility for understanding the projects they're managing, and wall themselves off in JIRA bureaucracy.

Engineers have not taken too kindly to it.
There was a similar show, called "Hugo" in Germany in the same timeframe...

Even with accompanying video games - ah, the memories...

https://en.wikipedia.org/wiki/Hugo_(game_show)
Pretty much all laptops have a sticker underneath that tells you not to use them on a lap.

My old dusty i7 laptop did get much much too hot though.
Vector clock
Triplebyte (YC S15) is hiring a Head of Growth to fix how engineers find jobs
My thoughts exactly, it was a nice try though, maybe a next version could actually parse the article in order to find the most prominent keywords/topics instead of relying on just the title.

I'm pretty sure this comment would have gathered a number of comments / upvotes if it was in the right context.
it's sloooooooow.

i can create two tickets in trello in the time it takes jira to load a page.
Smartphone with a finger crawls across the table to stroke your wrist