skysight-inc/HackerNews huggingface dataset:
> subsequent physical inspection revealed an implant built into the server’s Ethernet connector

It looks pretty clear that this is the hack in question, not an example.
The League of Movable Type
If everyone grew their own food in communes, the tax base wouldn't be there for Medicaid, highways, etc.
I'm building https://www.shareseer.com to make access to financial data easy.

Most recently I added a feature that allows download of financial statements for most US listed companies.
Try explaining to people that Kubernetes may not be the best option for large-scale hosting. I'm currently dealing with people who want to have a 'one pod per site' deployment model for 500,000 customers. Do the math on how many nodes that is with a 30 or 100 pod limit per node.
I don't know your location, but if you are in the US and running your own k8s on baremetals, I would reckon you should have at least 1 full time person on staff to handle all of it. Let's say that person costs only $50k/yr. Will your workload on Google cost more than $50k? Google pretty much really does all of the management for GKE. Just deploy your app and run.
It was because the server took a very long time to serve me the page. I figured it was being hugged to death.
Creation of user namespaces still has caused security vulnerabilities in very recent history. But with seccomp you can disable it inside a container (which is what Docker and LXC do by default for instance), and it doesn't make sense to be worried about that as a container runtime because you are using it to increase the security of your sandbox.
Maybe.. but this is a VERY sophisticated data migration utility.

It going wrong can mean crippled data!

I am certain /some/ code must exist to allow the authors to verify it does what they want so my question is more: where is it?
"The death of Intel..."
I searched for the title of the forum thread and found the post.
Compelled by what?
They're small, to be sure. You get 400-500 square feet. Enough to eat, sleep, work a little from home and watch movies with company. Perfectly livable. There's both modern and older buildings at that price range.
>GIMP, Inkscape, Audacity

Yep - all of those. GIMP has scripting capabilities and exposure to vulnerabilities via image codecs, same as Inkscape, and Audacity could be linked to ffmpeg, which is a huge attack surface.
And my friends think their phone is spying on them with the built in microphone, due to ultra personalized targeted data. Once I raise their awareness of scummy advertising industry privacy practices, in laymen terms, do they understand that there is a shadow industry tracking their movements and purchase history to manipulate them into purchasing products, do they agree that this is not the future they want to live in.

In my experience, the amount of people that care are simply ignorant of what's going on in ad tech, of no fault of their own. They are tech consumers, raising families, working 9-5, living their life.

We are the tech creators, we need to be looking out for them in addition to ourselves. How can we say they don't care when they simply don't understand?
Two that I run into all the time:
1. pairwise iteration over a (cylic) list of points representing the ordered vertices of a polygon will give you a sequence of edges

2. np.diff, takes differences between consecutive pairs. Sometimes you have a different kind of "difference" operation, though. The pairwise iteration helps you express that.
Of course it can't scale. Traditional universities by definition are expensive. People like to think of education as being a quality problem but the real issue is education is too expensive for most. We are better off with lower quality education that is affordable by all.
> All my movies and TV are downloaded to the NAS before I view them

> I feel so much secure truly “owning” my content

Do you actually purchase the content? If so, where do you buy it from? Is it even possible to purchase DRM-free content from major studios online?

For music, I can purchase music DRM-free from the iTunes Store or Bandcamp and actually own it, which is awesome.
Sorting only by upvotes will make some "classic" books be on top forever. You need to add some variation to keep the front page fresh. In HN the algorithm is essentially upvotes/age^2, so new post have a chance. (Actually, its upvotes/age^1.5 or 1.6 or some other magic number. You have to tweak it until the result looks nice.)

And you can add some other orders like https://news.ycombinator.com/best or https://hn.algolia.com/?query=%20&sort=byPopularity&prefix&p... if you want.

I agree with btian that it's a bad idea to link to pirated versions of the books. The copyright holders may not find the disclaimer at the bottom relevant.
Yup! We’re all employees of the federal government, so we have to meet the requirements of all Federal positions.

Honestly, you don’t do this job for the money. I took a pay cut when I joined, on top of losing bonuses and equity. You join because you want to make a real difference in people’s lives, in a visceral, real way.

I can say without exaggeration that there are people who would have died except for the work that our team had done. Even when the stakes aren’t life or death, the impact you can have working for USDS is massive compared to anywhere else. You can personally change the lives of hundreds of thousands or millions of people. That’s the kind of hook that beats equity for me any day.
Edge starts implementing Shadow DOM
I don't think that was ever true?

Docs: https://docs.snapcraft.io/build-snaps/electron

Example: snap info electron-quick-start
The TL;DR of the article is "Google is dying because ..Google+". Funny argument. If that were the case, then Google would be on life support since Orkut, Wave and many other bets that just didn't pan out.

The fact of the matter is: Google is by far the best search engine. Google is the only company I'd actually trust to drive me around in a self driving car. Its cloud services are 2X more cost-effective compared to AWS. Google's Android is by far the most popular mobile OS in the US.

Google is growing like crazy both in terms of employees and in terms of stock. Who even cares about Google+ ?
I am trying to set up my own such NAS, currently using Plex to manage movies & TV and for streaming on my PS4. Haven't figured out a solution for music and just use Spotify. Any software you can advise to help me create a better setup?
It's become one of those terrible words where people get into debates each using different definitions of the word without being aware of the difference.
Sorry, but - eh, how to say this. You wouldn't consult your dealer, to help you with addiction. Because your dealer will help you only insofar as it helps you to earn a optimum of money.
Or https://rootlesscontaine.rs/ [1]. runc has had upstream support for this for quite a while (binctr predates it by a bit, but the LXC support for it predates all of this by several years). If you want to run this in production, please use this -- or LXC -- rather than the PoC that Jess wrote a few years ago. umoci[2] also has rootless support (though it doesn't use user namespaces) for image manipulation (extraction and diff generation).

I worked quite a bit on getting this userspace stuff together (though of course the kernel work was done by much more clever people than myself :P).

[1]: https://github.com/rootlesscontainers
[2]: https://github.com/openSUSE/umoci
That's what the backup codes 2FA provides are for, no?
I may be mistaken but I'm fairly confident govcloud is an unclassified network.
Usually $0.60-$0.70/sqft. Some terribly built and managed buildings are higher. If you're at 600 square feet I wouldnt expect to pay more than $450/month.

This is however much less than the repairs and maintenance on a house. Replacing a roof? Furnace? Lawn work? Have fun.

Plus having concierge to receive packages for you is fantastic.
After several weeks of swimming upstream on a greenfield EKS project I switched gears to GKE. The paradigm just felt way better. For large enterprises that need IAM integration on EKS I suppose that wouldn’t have been an option but GKE just feels way more paradigmatic, for obvious reasons.

Did I mention we are hiring devops engineers? If you are a kubernetes guru email me :-)
I meant it in a sense of an enemy that can take on the high tech weapons. Since the Korea war nobody challenged the high tech equipment in meaningful way.
That’s funny, seems like reinvesting to me. Better long term returns.
I have nothing but praise for Xiaomi products. They are phenomenal value.

I have a Xiaomi Redmi 4x, which cost me $140 and has perfectly smooth performance. The camera isn't terrible either, it does the trick. Best of all, spare parts are cheap and easy to find. I completely shattered the screen on my phone, it was only $20 to get a complete new screen assembly (lcd, digitiser, and frame), which I'm fairly sure is OEM. I broke the ear speaker in the process of replacing the screen, only $1 to get a new one shipped from China. I can literally make a phone from parts, I can even buy the motherboard on Aliexpress.

Xiaomi have really good build quality too, and their their custom version of Android isn't terrible.

I also have a Xiaomi bluetooth speaker that I bought for $30, which performs as well as a speaker 2-3 times the price. It's built out of solid aluminium too, so it can take an absolute beating.
Edit: "Fixed" it, but failed to deregister them.

"The latest problem occurred when DMV customers, including some noncitizens, accidentally filled in the wrong voter eligibility response on driver’s license applications and asked staffers to make the corrections, the audit said. The revised responses were not correctly logged.

The error has since been fixed and affected customers will be notified, the DMV said."
> it's illegal to report an attack by US intelligence agencies

Can you provide a citation for this statement please
Intel is violating the embargo in order to give primay to their false narrative. That's odious.
Same way it works on the web: Use a broker process that grants access via a file select dialog.
>Well, yes, it has created the project and maintains it actively for years now. You're welcome as a contributor.

So, there cannot be a third-party/self-hosted snap store ? That seems like a major limitation.
Bubblewrap supports user namespaces and has for a while -- grep through the source for CLONE_NEWUSER. I talk about the security concerns a bit in [1].

[1]: https://news.ycombinator.com/item?id=18181034
Google are accidental PR geniuses. The whole 'do no evil' thing was instinctive PR, not really thought out in the den of some PR genius.

They made their brand synonymous with the word 'search' - my god man, that's worth billions, minimum.

They've done it in an oddly naive 'authentic' way, by I think truly believing their own schtick, and drinking their own coolaid. And I'm not nearly as cynical as the above posters, Google is way more ethnical that most companies. My god man, if Google wanted to they could change electoral outcomes, simply form a massive hedge fund and beat everyone at investing, do evil things the likes of which we've never hard of. I'm constantly impressed by how actually objective they've been about a lot of stuff given 99% of other CEO's would have abused the data position a long, long time ago. Not to say they are perfect, but ... compared to most, they have been pretty good. Though that's changing.

They've done it without any hardcore ad spends, or any real classical marketing attempts to make us believe things one way or another, so kudos on them.

But yes, they are kind of bad at most classical parts of marketing, communications ... heck even some kinds of product management. But the 'Engineers first' mentality got them where they are, I'm going to doubt that part of their DNA will change.
Everyone breaks laws all the time. The question is whether the Government decides to focus on your activities in order to identify your crimes.
Anyone who pre-orders a video game is buying for some speial sense of status, not product quality.
> That's disingenuous. Canonical works with many parties, and has people working on LSM stacking for example precisely to support co-existence of the systems.

I'm assuming with "LSM stacking" that you mean having both AppArmor and SELinux operate concurrently on a system, since you can currently have kernels that have both enabled, but only one at a time active.

Are you going to convince Red Hat to enable AppArmor and support stacking SELinux and AppArmor in RHEL? What about helping to maintain AppArmor support in Fedora? Without that piece, that's not a valid or useful solution because you're hoping for something that won't help any of those people (like me!) at all.

I'm pretty sure that everyone will say no to the idea of combining AppArmor with SELinux, since it's basically insane and requires developing and maintaining policies for both that don't conflict with each other. Having written these things for my apps, I wouldn't wish the combination of both on a single system on my worst enemy. That's a lot of security check policies to work through!

> We also had exchanges in the forum to discuss the implementation of actual backends in snapd to support it, but Canonical indeed won't pay for the cost of implementation until there's a reason to do it. That's business as usual and pretty straightforward.

Sure, but if people do keep asking for full support, that implies having SELinux support to enable full confinement. As I said above, unless you intend to actually do the work and convince Red Hat to make the necessary functionality available, you're going to need to support SELinux as a proper backend.

> Well, yes, it has created the project and maintains it actively for years now. You're welcome as a contributor.

I think you missed the point. But sure, maybe. If there wasn't the CLA to get in the way... Why do you have that when you already offer it under a nice copyleft license?
I don't know about git integration but as for Flatpak version of Sublime Text, I found this:

https://flathub.org/apps/details/com.sublimetext.three
Perhaps it could be cross-posted?
Below are two questions that I ask myself, when I need to do a task I do not feel like. My experience has always been that the impedance is higher at only start of the task, and if the answer to any of below two questions is Yes, then the value of outcome would supersede my initial uneasiness.

1. Would the value created by this task reduce over time? In other words, is it better to do this task today than in future?

2. Does the effort required by the task increase (or remain same), if delayed? In other words, is it easier for me to do this task today than in future?
It should also be noted that bind-mounting docker.sock is equivalent (or much worse -- it's easier to exploit at least) to using privileged containers, and an exceptionally large number of people do this (you see it in many blog posts and project installation scripts).
Most of the comments outline how awful and dire the situation is (or probably is).

I'm less interested in this than I am in what we could do to fix it. Is it just more money to hire competent security engineers? Is it a more responsive talent acquisitions process that gets the right people in at the right time?
> My point is simply that I, as a user, am never going to use software that wants me to install it this way.

I, as a developer, am not sure I care. It's tough for me to care about Linux in the first place (you guys are picky!), but let's say I went through the trouble of maintaining multiple third-party repositories for major distributions, how exactly is that more secure from your perspective? You still have to trust that I don't ship malicious binaries, just as if you just had downloaded the package from my website. Worse yet, you also trust that I maintain all these repositories securely, which means a bigger attack surface for you.

> The extra work involved in setting up secure distribution is a feature, not a bug.

Except it isn't really secure from a technical perspective, it's literally just more work.
GitHub repository for the data behind The Economist’s Big Mac index
The Pact Smart Contract Language
The Economist plans to release more of its data as outlined in this post [1]

[1] https://medium.economist.com/peeling-back-the-curtain-487bd3...
They "corrected it" in the sense of allegedly fixing the problem for new applications, but they have done nothing to deregister any of the 1590 who were illegally registered. The most they are doing is sending a letter to those who were improperly registered.
I use a computer running FreeNAS with a shared NFS amount for the audio and video content. You can use SMB (Windows shares) too. I use a low powered set top box and a Mac Mini both running Kodi as clients. Works great.
I thought the seccomp-in-seccomp thing would have messed things up...
An vehicle with improperly installed brakes or other unsafe mechanisms can easily cost far more damage than the value of the car.
https://news.ycombinator.com/item?id=18176620

700+ points
Yes, it appears that the flathub maintainers have published Sublime Text under flathub. This is not an official distribution channel by us, and looking at the spec (https://github.com/flathub/com.sublimetext.three/blob/master...) it seems to rather automatically install Package Control, but also in a rather brittle way. Sigh.
Police Force Suspect to Unlock Phone with Face ID
Why are they leving out andriod on pixel slate and moving to chromeOS? so the future phones will be on chromeOS?
In this case I suspect Haskell just passes the appropriate "view" of the value, since it knows what the target type class is at any given point, and - most importantly - it can't be "downcast" later through that same value; you can't do a runtime check for whether a given Convertible<T> is also Convertible<U> (either explicitly, or observable via dynamic dispatch). In Java, it's possible, so even if the code never actually does that anywhere, it always has to be pessimistic and assume that someone somewhere might.

But I'm not sure that truly counts as type erasure. If that's how things are done, then the type class of every such value is effectively encoded by the set of function values that are passed around, and could be queried at runtime - the Java equivalent would be to tag every reference with its class, including all generic parameters used to instantiate it.
> It isn't great, but all I/O is redirected, so in your example, tar would think that it's writing to /home/voltagex but it might actually be writing to /run/sandbox/blah/home/voltagex - so if something ran rm -rf it'd only delete the sandboxed home.

Then how do you get it to operate on your actual home directory when you want it to? Making it operate on some different structure has been possible with chroot() or LVM snapshots or a number of other things for a long time.
A very valid concern- I was in a serious vehicle accident this year and it took weeks for all of my keys and possessions to make it back to me. Luckily I didn't need 2FA for my email or insurance.
At least publicly, they're acknowledged to go up to Secret right now. https://aws.amazon.com/blogs/publicsector/announcing-the-new...
It wasn't noise-cancelling not being perfect (it worked just fine), but noise cancelling going bonkers when the earmuffs come into contact with another solid object (in my case, neck cushion on seat). I think it broke the around-ear seal a teeny bit and that threw the noise cancellation off.
Uphold | Multiple Positions | Braga, Portugal; NYC, NY; Bay Area, CA; Tampa, FL | Full-time | Uphold.com

Uphold is a next-generation financial services platform that uses blockchain technology to democratize access to investments and other financial services. We have fought to provide a fairer, easier and more affordable system. We favor speed, simplicity, and ease of use over complexity. We put security and transparency first. Our commitment to transparency sets a new standard for the industry. Unlike banks, we are fully reserved, and transparent: we hold assets to match our obligations and publish both in real time.

We’re launching revolutionary digital yield and lending products and a brand-new App. Use your crypto investments to earn interest up to 5%, or borrow as low as 9% in the world’s first crypto line of credit.

We are looking to build out our global team at our Bay Area, NYC, Tampa and Braga, Portugal locations.

To learn more about our open positions visit our careers page (https://uphold.com/en/about-us/careers). If the position you are interested in does not have a JD posted please feel free to reach out to the email below with your resume.

Please send resumes to Kaily.Burton@Uphold.com with the subject “HN + PositionTitle”.

We can wait to speak with you!

NYC: Director FP&A, Data Scientist (junior-manager), Data Analyst, Senior Accountant

Larkspur, CA: VP of Business Development, Copywriter/Technical Writer, Content Marketing Manager, AP Accountant

Tampa, FL: Network Operations Manager, Fraud Prevention Manager, Sr. Case Analyst

Phoenix, AZ: various Security Analyst positions.

Braga, Portugal: FE, BE, DBA, Data Engineer, QA, etc.
If you give performance bonuses and people work too hard to meet them people complain about work conditions, and if you just pay everyone more instead, people complain that you took away the performance bonuses.
What graduate level mathematics courses are relevant for these Wall Street jobs? Your comment has me interested in taking some of these courses.
By default, flatpaks don't have r/w to your home.

And setuid binaries have been blocked for a while (as the article says). Plus, selinux will have these things locked down on a system that uses selinux.

I think the problem is part perception. Flatpak, like Docker is not primarily for security isolation. It's isolation for ease of deployment - to avoid dependency hell.

Not saying Flatpak's failings are not a problem. Just keep some perspective.
> Distribution repos help mitigate some of that risk. Flatpaks as a technology don't change the risk (significantly) from a bit-rot point of view IMO.

I don't agree. There was a FOSDEM talk by one of my colleagues specifically about this issue, and why Flatpak is walking us backwards in terms of how packaging has worked historically[1]. Distributions are far from perfect (hell, some of them ship my packages and I'm definitely far from perfect) but they do solve real problems and going to a Windows-DLL-dump method of packaging is going in reverse.

If your "package format" makes developers maintain all of their dependencies, it isn't solving the problem that most people actually want you to solve -- to be able to do less work and build on top of other people's work. By using dependencies maintained by your distribution you also get security updates and maintenance for free -- many distributions have paid security and maintenance teams that deal with precisely this. I cannot overstate how much work it is to maintain your own distribution.

[1]: https://www.youtube.com/watch?v=mkXseJLxFkY
Yes, but the Pixel screen doesn't go to the edges. There's a sizeable bezel at the bottom. Could have left one at the top as well, and avoided the notch.
I contemplated a startup a few years back that would let people copy the text from coding tutorials. Uploaders would include a text file/repo for the work they're referencing in the video and it would get cross referenced when shown on the video to ensure the text was 100% accurate when copied.
Does anyone know which algorithm they use for super resolution in the camera app? I know they're using RAISR [0] for zoom in the previous version, seems like they have a new method now with multi image super resolution.

I doubt it's anywhere near as good as a second camera with a different lens, so I don't understand why they won't include a second camera in the back like every other modern phone.

[0] https://arxiv.org/abs/1606.01299
I am a Pope. are you?
That causality assertion is hard to prove... Maybe true for you, may or may not be true generally.
I just rip my Blu-Rays and stream them through Plex.