skysight-inc/HackerNews huggingface dataset:
Theory of Relativity
- Albert Einstein, Senior Executive Patent Clerk
> Wouldn't it be better if Paramiko was obliged to access your keys via the agent?

That's just kicking the can down the road. You get the same exact problem, but with the agent permissions rather than the actual keys.

The problem is "I installed paramiko and I know what it does and I want it to access my SSH credentials, but I don't want evillib123 to access my SSH credentials even though I have installed it as well and I think I know what it does, but I am mistaken" and the distinction between the two cases above is in the intent and judging intent is hard.

> One of the obvious things the agent could do on a workstation is mention that your keys are being used

This has been tried many times. Windows UAC is one of the more ubiquitous and notorious examples. If everything starts sending you notifications you stop paying attention to them. That is what happened to UAC, it would notify users about important things, software installs, system setting changes, admin accesses etc. but it was doing it too much and most people would just click through without actually reading what the notification is about. And the reason it was doing it too much is because it cannot judge intent. It cannot tell the difference between me installing an application deliberately and me installing an application because I was tricked into it somehow.
Went the other way, for me. I used to love tonic water, neat, but it's gotten to be so sweet that it's unenjoyable.
>If you break both of them up too much, they may be unable to compete against a major Chinese manufacturer when it scales up.

This is a crucial point that so many people seem to miss. If you want to break up these companies (manufacturers, banks), they are going to get absolutely crushed in the global economy, competing against Chinese state-sponsored companies.

In the game theory of open global commerce, it pays to cheat.
zeroheight (YC S19) | London, UK | Onsite | Full-time | https://zeroheight.com

We started zeroheight to work on collaboration between designers and developers. This led us to notice that there was no good solution for design documentation...so we built one! Our goal is to give companies all the tools they need to build a full "design system" and maintain design consistency as their products scale.

We think design systems have the potential to change how companies build products. Creating a shared language between design and development opens up some exciting possibilities. We're still hiring our first few engineers so this is a great opportunity to have a large impact on the future product building process.

Role: Product Engineer (Full-stack) | £45 - 65k + equity

Tech: JavaScript (React), Ruby (Rails), AWS (RDS, EC2, Lambda)

More: https://zeroheight.com/careers or email me (Robin, founder / CTO) on robin /at/ zeroheight . com
Sorry I have difficulties parsing what you wrote. What exactly do you mean? Who are the bad actors?
Antitrust and Zero-Price Digital Platforms
I can't think of a single broad economic axiom or theory that doesn't depend—wholly or in-part—on the principle of ceteris paribus, which excludes their practical application to essentially everything in real life.

In a few cases, economic theories do a passable job of roughly mirroring real-world behavior, but that's the exception and not the rule.
It wasn't law enforcement taking the domain name, it also was only solved fast because of intervention from the Namecheap CEO.
I was was on jury duty about 10 years ago and any white union members or anyone affiliated with a union were sent home by the prosecuting attorney.

This article is trying to make it seem like it's only done out of racism, when in reality, it's done to potentially help an attorney's client..and a person with any gender, skin color, political affiliation, or other bias can be eliminated.
>The manufacturers make money from the smart features by selling the data and by getting a cut of subscription revenue, so smart TVs can be sold cheaper than dumb TVs.

Yeah, this is like how a laptop can be sold cheaper with Windows OS than with Linux: the Windows version is preloaded with a ton of crapware that the mfgr gets paid to preload, so even with the enormous (as a fraction of BOM) price of the Windows license, the laptop comes out cheaper.
I have no idea. This was India in 1981. There was this "general knowledge" that it was expensive so I never even bothered to find out! Esp. since my beginning programs were well within 300 lines, and the rest I could get by using cards from friends. I never thought of this way until now, but we were trading cards: "Does anyone have a 'FORMAT INT2' card"?

I'm not sure it built any character!
"Even cars built for autobahn travel will not survive a major crash at that speed. "

I don’t care if they destroy their own cars but in reality they will destroy other people's cars. You also can't expect other people who do their daily driving to account for idiots going at such high speed. Just a stupid and reckless thing to do. With all the Twitter shaming going on for minor offenses these guys deserve a major shaming.
We're already crowd souring this when you run things like npm audit, and github stars, docker downloads, etc.

The problem is a tragedy of the commons in where we expect everyone else to do this for us and nobody does. This is why we need to rely on our own developers to actually do the reviewing, and why we have the monitoring to identify when that fails.

The more ways you attack the problem, the less likely you're going to be completely owned by a failure. Obviously sticking to a small number of generally trusted popular packages will likely make it easier to establish trust than using 1500 of them.

Obviously all this allies to other layers, such as Linux, your cloud provider, your hardware, your CI/CD, your secrets manager.
If you're in so many channels that this is a problem then you have too many channels.
Two things...

> if he drives the same kind of car and lives in about the same kind of house?

Most wealthy people don't behave like Warren Buffet.

> It means he has more power than me in a capitalistic system

Which allows him to shape the system however he chooses, and as is the case this is usually in favor of the power holder.

> But is that really so wrong or unfair? I think it’s actually kind of a good thing: most people would just consume like crazy and ruin the planet if they came into that kind of money...

In other words, poor people can't be trusted with money so they should remain poor and deprived?

If you honestly believe that people can't be trusted with their money then why not have a system where people aren't as reliant on money? (e.g. free health care, free basic housing, free public transportation) In such a system you don't have to worry about people abusing wealth they can't control.
Well this is ■■■■■■ we are talking about and after all, this an ■■■■■■■■■■■■ issue anyway.

Having ■■■■■■ run our lives like this and with the crowning of ■■■■■■ ■■■■■■ of ■■■■■■■■ and ■■■■■■, I don't see ■■■ changing or ■■■■■■ doing the same anytime soon.

So as long as we all have ■■■■■■ ■■■■■■■■, we are all absolutely ■■■■■■■!
It's not about bad faith, it is about showing the absurdity of aiming for representation of people by sexual preferences.
Another insidious exploit is to hijack the maintainer's package manager account and push the code directly there, bypassing the repository altogether. It doesn't rely on you installing a new package since the hijacked package in question is already a dependency of yours.

I got into a habit of checking both the package manager and the project's repository before updating any given dependency.

https://news.ycombinator.com/item?id=20377136
If so, it’s only because I was making the IMO generous assumption that your original reply was meant to actually refute my thesis that “ America has been one of the freest countries in the world for at least 150-some years.”, and CDSlice’s argument that “America could still be one of the freest countries in the last 150 years if most everyone else was even worse.”

If you were intentionally making insufficient and hence irrelevant points, why wade into the thread in the first place?

> I think there are lots of Western countries that have never had laws barring people from voting due to their race.

This might technically be true, because many of those Western countries have taken the further step of abolishing democracy altogether. I hope you would agree that the various fascist and fascist-adjacent dictatorships of 20th century Europe were “even worse” than racial disenfranchisement.

> E.g., there has never been any such law in the UK.

The use of “e.g.” here implies that you’re discussing Western countries in general and not just the UK. Also, this point is rather fatuous for reasons I’ve already discussed.

> Women in the UK also got the vote slightly earlier.

This is false, as I’ve already discussed.
We use lombok, and the toString annotation is immensely helpful for logging and avoiding this type of thing.
That works if your TV allows that. I'm pretty sure I've read that some models simply won't work if they don't have internet access.
That's valid, but it's also why HTTP/3 is being pushed for 1-RTT and 0-RTT connections (0-RTT is most likely going to be enabled for their DoH if it isn't already)

https://blog.cloudflare.com/even-faster-connection-establish...
>Given that the FDA is a product of a democratically elected government that is ultimately accountable to the people

The head of the FDA is appointed by Donald Trump.

>If I don't like the FDA, I can vote for someone who will fix it.

Do you have any evidence to support this claim?

https://www.usnews.com/opinion/blogs/charles-wheelan/2014/04...
Ha! Yeah, the light touch worked so well for the 737 MAX. Well at least the first flight of their capsule will be unmanned...
I never understood why this was a problem MS never felt they needed to address in the OS itself (architecturally). At this point, AV software should be obsolete. But, here we are.
That's mostly because "Martini" is the prevalent brand of vermouth in central Europe. It's super confusing... https://en.wikipedia.org/wiki/Martini_%26_Rossi
I think a more modest re-engine of the 737 would absolutely be approved. They’d have to sell it at a discount vs the a32x, obviously.
If you're on your company-provided system you probably don't have the ability to change any anti-virus settings. Corporate IT admin rarely trust us to not just turn it off because it's annoying.
> Shadowserver Foundation
Assuming you talk about publishing a library instead of a snippet in the first place, the main difference would be one puts the onus to every client and the other on you.
It's sad that we live in a world where reducing poverty is somehow a hot take on society. I do not understand why some people believe it is impossible to rise out of poverty without seizing someone else's property. Capitalism is not a zero sum game
I wouldn't be so sure, passenger comfort was a big selling point of the 787 and the A380.
They're far too horizontally integrated. Reducing vertical integration is part of their quality problem resulting from adopting black-box management, see:

http://seattletimes.nwsource.com/ABPub/2011/02/04/2014130646...
Why should Python program have access to SSH keys? Popular Linux distributions, unlike proprietary systems like Android or iOs, cannot protect user's data from malicious programs run by the user.

Also, in popular Linux distributions programs can read unique hardware identifiers like MAC address or HDD serial number, read browser's history and cookies. These valuable data are not protected by Linux.
I stand corrected.

Wikipedia says it's a eukaryote. Means I probably still have it.
I have great fun playing chess with a friend who easily has 600 ELO on me. Before we start each game, we agree it will be one of three types:

1. No holds barred. (I always lose, but nearly won once when they were very distracted.)

2. Like no holds barred, except I can take back my previous move && they sometimes offer “Are you sure that was the best move?” when I’ve done something especially wrong.

3. Them vs. them + me, where I have full access to their skills and knowledge. They suggest moves, and I can ask whether a move is/was a good move, what move they would make, etc. This unsurprisingly results in a 50/50 win rate.

This has been very useful for learning because it balances out the learning with just enough “winning” to keep the game fun.
>I opened a more modern cheap smart TV. Inside were three boards: Power supply & backlight inverter,

How "modern" was this TV? Don't they all use LED backlights now? Backlight inverters should be obsolete now.
That's a false dichotomy, though. You can be part of a group and not succumb to toxic groupthink.

In many ways, groupthink can be enormously useful. In a sense, universities, books, and other knowledge dissemenation mediums exist to solidify useful groupthink. Maybe one guy comes up with some small piece of math, another guy on the other side of the world comes up with another piece, and everyone makes their various contributions until someone comes along and rolls it together into theory that advances the world.

People who don't think like the group are reformed or weeded out so everyone understands how to "properly" study the world and you don't end up with a bunch of cranks coming up with intellectually lazy speculations.

So that's good groupthink (but people don't call it groupthink, because groupthink is generally considered to be the negative version of that). The problem is when groupthink becomes detached from reality.

But back to your original point: no, if I'm part of a larger group and I start to disagree with them because I think they are wrong, that does not make me part of a group. It's just me. I could organize a group of dissenters and form a critical mass to change the group, but that's not typically what I do.

Furthermore, the argument that "everyone is unique like you" to criticize counter-cultural movements is attacking a strawman. Maybe unintelligent teenagers think they're radically unique. But counter-cultural movements are very much groups. Humans work best in groups. We think best in groups. No one can accomplish very much alone.

All the thoughts I have, and all the thoughts you have, are plucked from the ether of the prevailing beliefs of our times. I can explain to you my personal philosophy, and you could sit down and trace my intellectual lineage if you really wanted to. You could observe how I picked the belief I'm arguing for after reading Carl Sagan at 16. He got it reading some other guy who got it from Schopenhauer or something. Maybe some of my Baptist upbringing is sprinkled in too, which comes from the Bible, in a line of intellectual descent that can be traced back to Zoroastrianism and beyond.

In the meantime, there are a thousand other youngish programmer dudes who read the same books that I did, and we talk to each other on the internet and reach group consensus. We bounce ideas off of each other and bring each other in line -- just as we're doing to each other at this very moment, on this very forum.

People who think they're radically unique are wrong. We're social animals. But that doesn't mean having the courage to dissent isn't important.
> Well, in the US, as possibly in other places, elections are usually won by the candidate who receives the most corporate support

Again, this is orthogonal to the point about inequality. Insofar as corporations or money are involved in politics in America, it's for campaigning — buying TV ads, flyers, etc. While it's true that this makes it easier for richer people to get their message out there, the fact of the matter is that the message still needs to resonate with a broad enough polity capturing working class, college educated, non-college educated, urban, rural voters etc (see: the Electoral College).

Just to give you some numbers, in the 2016 election, Hillary Clinton outspent Donald Trump $132M vs $92M.

In the ongoing Democratic Primary for the upcoming 2020 election, the TV ad spending through 12/3/2019 is as follows. The candidate's polling percentage at the same time is included in parenthesis.

Steyer: $63.4 million (1%)

Bloomberg: $37 million (<1%)

Sanders: $6.7 million (15%)

Buttigieg: $5.1 million (13%)

Yang: $2.9 million (4%)

Biden: $1.7 million (25%)

Klobuchar: $1.3 million (3%)

Bennet: $1 million (<1%)

Gabbard: $1 million (1%)

Warren: $926k (18%)

Delaney: $662k (<1%)

> On top of this, a bipartite political system can quite easily keep out candidates with views that are unpalatable to the rich and powerful (e.g. see how Bernie Sanders was treated by the Democratic establishment in 2016)

You're right about this, but the Democratic Primaries are not a good example of a democratic institution (ironically) — it's a private club and they can make their own rules, for better or for worse. During the general election, the opposite happened; the rich and powerful overwhelmingly supported Hillary Clinton, and yet she still lost.

> Individuals mostly rubber-stamp one of the two mainstream candidates.

This is true, but has nothing to do with economic inequality. The two-party system is an artifact of the first-past-the-post voting system. Since ~1860, there have only been two mainstream candidates, and inequality has varied wildly in that time period: i.e. no correlation.
The radar-jammers and tail-light kill-switches are very obviously illegal, even if you cannot prove they were used.

Don't commit massive crimes then brag about it on the internet.
Thanks, though I was hoping for better than an HN comment...
Invasive grasses are fueling wildfires across the US
I just wanted to make the point that there might be a better graph.
As a paragliding pilot, this is one of the best weather resources for me (along with https://meteo-parapente.com/). Fantastic visualizations, fantastic data sources.

Note: Depending on your region, it might be a good idea to compare forecasts of different weather model. GFS with its 22km resolution is not well-suited for forecasts in the mountains, where the model may completely "overlook" an entire (large) valley. Weather phenomena like the Föhn are also not modelled well. ECMWF with 9km resolution is often better. In the alps, I've had good experience with NEMS (by Meteoblue) as well as COSMO by Meteoswiss (which is not (yet?) available on Windy).

Overview over the prediction models: https://community.windy.com/topic/12/what-source-of-weather-...
We'll, I guess all notions can seem silly from some perspective. Children climbing up chimneys or adults wearing diapers to meet chicken plucking quotas can seen silly from a certain perspective, but usually not a first person one.
>* Theft or loss of the laptop does not mean loss of token.

Doesn't seem relevant when you probably have FDE enabled.

>* Even if the token gets lost, cracking it will be hard. A dedicated attacker might be able to do it, but a 6 digit pin with 3 tries is hard to guess. Decapping and convincing a yubikey to reveal the secret key is likely possible, but nontrivial.

To be fair, if you weren't using a token, and were just storing the password protected keyfile on your FDE protected computers, there's nothing to "lose" either.

>* Attacks where the attacker can read files do not turn into a compromise of key material.

Only if the keyfile isn't password protected.

>* Even a compromise that allows code execution would require a sophisticated attacker to pivot: You'd need to figure out how to make good use of the acces gained either in a fully automated fashion or be online when the victim has its token plugged in. You cannot collect the key and later figure out what to do. This pretty much rules out attacks such as the one we're discussing here.

Keyfiles are already harder to monetize than other information you can steal off a computer. There's no market for id_rsa/.asc files, but there are for credit card numbers, personal info, bank/email logins. You have to put in the legwork to make money off them (eg. logging into each server and checking what's on it or whether they can be used to pivot elsewhere, seeing who your contacts are to see whether they can be duped using a signed email, or checking whether you're a maintainer for a software project and using your key to sign a malicious update. Therefore, it's safe to assume that attackers interested in your key files are also sophisticated enough to perform the pivot.
I can confirm that McAfee and Trend Micro do the same thing. McAfee even goes so far as to lock files in your AppData and Tmp folders until it's finished checking them. This causes havoc with a lot of apps and makes certain ones completely unusable.
Airbus isn't focused on profit (cutting corners), it's focused on politics (i.e. providing jobs in different countries). Hopefully that would make (local) engineers more powerful...
While patches would have helped in this specific case, that's only because Merck was collateral damage.

In a targeted attack, it's likely the foreign agency would be using a 0-day attack.

The only way to protect against that is by reducing the OS monoculture, offline backups, and using network air gaps on critical data.

But those practices are extremely rare in my experience.

If I was on unfriendly terms with the US, I'd use this as a case study on how to cripple the economy by taking advantage of the large monocultures created by lax IT in a hundred or so of the largest firms.
> They’re far too vertically integrated.

In what sense? I work with a lot of Aerospace, Transportion and Logistics companies and I've personally seen tens of hundreds of companies that are suppliers for Boeing/Airbus. What do you think GE, United Technologies, Rolls Royce Aerospace, etc. all do?
Speaking for myself, the reason I’m not even writing the N word when discussing it isn’t because it’s more severe. The other term is so loaded that, in the early 2000s close to where I lived in the UK, a gang set about the house of a paediatrician because the mob didn’t know the difference — if the N word is more severe than that, then please let me know so that I can apologise for underestimating its effect.

Rather, the reason I’m avoiding the N word is that it targets an innocent group who are essentially my equals and who are only poor because Western Europe happened to go through the industrial revolution first (someone has to be first) and thus conquered around a third of the planet between them.
Yes because otherwise one user could configure a fake printer and see what others are printing. Although for one-user system this doesn't make much sense.
Like this? https://support.mozilla.org/en-US/kb/firefox-dns-over-https#...
You can install new interiors at any time, it's just not worth it for old planes with a limited future (because they're gas guzzlers).

Planes can essentially fly indefinitely if you're willing to put money into ongoing maintenance. For instance some B-52s will have served for roughly 100 years by the time they are retired.
Mac has started prompting users when programs access the file system. I hope they implement a HUGE warning is that directory is ~/.ssh

> These valuable data are not protected by Linux.

That’s extremely scary to me.
Wow super psyched I got triple downvoted when I dared to say something mean against one of the great deathstar companies. I've noticed if I ever dare to say anything mean against amazon or google I get instantly downvoted. It is more reliable than a bot.

Anyway, dynamodb is insanely expensive compared to postgresql and I'd recommend only using it when you need to expose a datastore directly to the user as it's attribute based access control is easy to use. Postgresql serverless is now a thing as well. Anyway, if you truely want a WAN datastore, exposed to web clients, with attribute based access control, run dynamo.
Android isn't proprietary.

On the other hand, Windows and macOS, which, as far as I am aware, also have this problem, are proprietary.

Hence, I don't see why an argument like "unlike proprietary systems" is justified.