skysight-inc/HackerNews huggingface dataset:
I wonder if this is the end of drivers for 3rd party PCIe/thunderbolt high performance NICs? I imagine that this may make Macs less viable for situations where having a reasonably high performance 3rd party NIC is important (eg, video editing).

Are there any details about DriverKit that are available?

I used to be a Mac driver developer ~10 years ago or so. I did one of the first 10G drivers for Macos, and MacOS performance was always terrible compared to Linux or BSD, but I can't imagine that moving it into userspace is going to help anything. MacOS boundary crossing (eg, syscall, ioctl, and Mach traps) performed even worse than their network stack as compared to Linux/BSD.
The title is misleading. HiSilicon is responsible for the SoC, but the backdoor is part of the Linux-based device firmware made by another company called Hangzhou Xiongmai Technology Co. There is no clear connection between Huawei and Xiongmai.

You can find the clarification about the firmware maker (Xiongmai) towards the end of the article.
You have to open it up and inspect the hardware.
> Elm + JavaScript is generally painful

Getting rid of kernel modules for everything others than core packages in 0.19 made JS <-> Elm interop even more painful and broke some apps. I forked the compiler [1] to support that, although it is not upto date (still stuck at 0.19.0)

[1] https://github.com/Checksum/elm-compiler
Hmm I just checked and I have far fewer 3rd party kexts than i thought.

8 hackintosh related kexts, out of which one is for the temperature sensors that i can live without.

What worries me is stuff like Paragon NTFS, intel haxm for Android emulation, osxfuse used by pCloud...
LuLu uses the now deprecated NKE API, and definitely does some things that aren't supported by the replacement NetworkExtension framework. [1]

I've looked at doing some similar stuff, and I think they'll have to reimplement it as a "VPN", where the VPN is really just a user space process that performs the desired filtering. It'll be interesting to see how the Little Snitch guys approach it.

1. https://developer.apple.com/documentation/networkextension
Show HN: The bridge between sellers and shoppers
As a user, even if you're up about these things and why they're important for product development, my answer is still "No."

Because I will only say "Yes" if I'm being paid or otherwise compensated specifically for that input.

I think it's important companies pay for usage testing so that they value that information and are more likely to hold it closely since it represents an investment and is perceived as competitive advantage.
The link to the APK is in the last paragraph of the article.
Sounds like we should put labels on our inputs, and a better error message :) thanks for the response!
Kexts will be completely removed, as long term plan.

It goes into two steps.

1 - A new user space API for what was previously kernel API gets introduced

2 - There is one OS release where the kernel API gets deprecated

3 - The release thereafter removes the kernel API

Long term roadmap is to make macOS into a proper micro-kernel OS.
I would unplug them to avoid creating air pollution.
That's honestly a very postmodern view! I think given that the article linked doesn't have any experimental or quantitative basis, I'll choose not to trust it.
FOSS firmware would be a nice, but unless someone verifies that firmware (could be maliciously a spaghetti), then it doesn't have much use.
None of the points you raised are about peer review...
You had to be very careful programming the Amiga. There was multitasking, but no memory protection. If you wrote to a bad address (like a null pointer), you were staring at a "Guru Meditation" screen followed by a reboot.
this will be the nail in the anti-trust coffin
It is both of those things.

And why wouldn’t it be? Huawei is a large organization and, like all large organizations, will consist of a multitude of different groups all trying to achieve the same goal in different ways. Some will want to rob the bank by tunnelling quietly into the vault at night, some will want to walk through the front door with a sawn-off shotgun.
You say that the mono-repo contains a collection of "related" projects, but how many of those projects is it possible to install and use without installing and using at least one other project from the same repo?

It's possible to have a system with "ls" and without "grep", and vice versa, at least in principle. More importantly, it's possible to replace "ls" with a competing implementation, without having to change "grep". The systemd ecosystem is not structured in a way that lets alternatives be explored.
Nope. Even USB cables now have active electronics and a microprocessor in them.
Actually, they are quite helpful on the developer forums.

Fully agree on the documentation point, though.
> A simple cell phone charger becomes a listening device that could have an LTE modem hiding in it.

You can already get USB cables that have a hidden mic and sim, so if powered you can phone up and listen in. Those a very cheap and google shows this, but this is more adventurous.

As for targeting hardware and security - how many people would question a fancy free mouse or keyboard arriving in the internal post as it happened to of been dropped of at reception. Great pentesting trick btw.

As for chips with `hidden/undocumented` remote activated features. If it was documented, would it be bad or something you can use or actively block off. When they are undocumented, well - hard not to think the worst. But then, CPU's today, not fully documented when you can't hack away at the microcode and management and whatever else is DRM'd out of your reach.

If Intel was a Chinese company instead of American - how would Americans feel about Intel chips? That is an interesting thought exercise.
>"See the section about "CBC with Counters"."

That section is talking about using an incrementing counter as the IV--it doesn't say anything about a PRNG being a bad choice (in this case, the PRNG being a SHA256).

>"By studying the source code, we can see what gets fed into the SHA256 inputs. The cost to brute force all possible inputs is definitely much lower than 2^128, therefore it weakens the IND security of the AES-CBC scheme."

Are you talking about brute forcing the IV? The IV is not a secret to anyone--it's usually appended to the cipher text.
I think you might be underestimating:

A) the number of degrees of discomfort between, "I can talk about this any time with no effort", and "I literally can't talk about this".

B) how normal it is for certain types of people to struggle with this kind of interaction in general.

On the first point, I am perfectly capable of being frank with friends. I am perfectly capable of telling them how I feel. And when I need to have confrontational conversations with friends, I do. But that's not the same thing as feeling no aversion or worry at all about disappointing someone. And if a crutch exists that mitigates part of that problem, I just don't see the harm in that crutch.

There are dozens of tiny, inessential affordances everyone gives themselves every day to help manage non-crippling problems. That's normal. It shouldn't be weird to anyone that people with even mild anxiety around friendships might want similar affordances. Sometimes it's not about necessity, people just want a tool that makes their life easier.

On the second note, I'm not going to go in depth here, but people who don't struggle with social anxiety usually don't understand how many other people do, or what their experiences are actually like. There's a pretty wide range of different annoyances or aversions that people can have about this stuff, and I really don't want to pretend to speak for other people. Some introverts don't struggle with this at all, some struggle in completely different areas.

I am speaking in very broad generalities. But I consider these to be very common situations for someone like me:

- going to an event I'd rather not just because I don't want to disappoint a friend or make them think I don't enjoy their company.

- actively not inviting a friend to an event because I'm worried they'd only come out of obligation and would resent that I asked.

- feeling like if I just express interest in changing plans a friend will accommodate me even though they had their heart set on something.

I'm not going to say people like me are a majority: we're definitely not. But we're not that rare. If you've never had even a casual acquaintance like me, you're not looking very hard.

> I can't imagine being friends with someone who is this incapable of communicating.

I realize this is somewhat blunt and a little uncharitable, and I don't mean it as an attack or as a character flaw -- but in the general spirit of being confrontational and open: when I hear this, my immediate thought is, "this person probably doesn't have many introverted friends, and they probably don't have many deep, honest relationships with the few introverted friends they do have."

Your perspective definitely isn't uncommon, and it shouldn't surprise me when I hear it, but I'm always surprised anyway. :) It's like seeing someone who lives in a completely different world, to the point where when they see the world I'm familiar with it's not just unexpected to them, but so unexpected that they think, "there must be something wrong with that."
>It's not like nspawn just calls into the service manager to get things done on its behalf via dbus or something like that.

Yes, it literally does? https://github.com/systemd/systemd/blob/master/src/nspawn/ns...

Additionally there is a lot of shared functionality in libsystemd. Take a look at the rest of the code in nspawn and see how little it actually accomplishes.
It has lots of rebranding. I often see "natural glutamates" on menus at nice restaurants, and I have a bottle of liquid aminos from Whole Foods (ironically[0]) at home that is basically a soy sauce derivative with extra MSG; it's actually really good.

I kind of wish I got to taste 80s era American Chinese food in it's full MSG glory.

[0] https://www.wholefoodsmarket.com/blog/whole-story/myths-and-...

> The short answer is that MSG, or monosodium glutamate, is an unacceptable ingredient at Whole Foods Market, thus not allowed in any of our products.
> If Apple still made great software and even better hardware then I wouldn't care, but that hasn't been the case for years.

Can you tell what is a better hardware and/or software for you?
Is this the recent announcement you were thinking of? https://xnrgi.com
This would be a real challenge for some companies. Having a clear privacy policy creates a hard dependency between it and the code. And developers are notorious for not even being able to keep comments updated along with their code changes.

It's not impossible at all, just in the current state of the industry there's a good reason we have vague agreements (also including good old-fashioned laziness, of course). It'd probably need to be developed ground up as an API with side effects, so when the code is compiled it spits out some details about how it's used.
There's going to be good money to be made in climate change-related real estate trends!
Dorothy would give you a hard stare.

And defund your project.
They announced one OS release for deprecation period after an userspace API for a previous Kext gets introduced.

So now that Catalina is officially released, they are following up on this.
Well there's not much to do about the drivers, but report your bugs to the intel iGPU team and Dell.

Try setting up TLP and see how your battery life changes. I've tried doing without and the difference is huge.
It doesn't help to call the desire for single-family homes "fetishizing".

The reality is that single-family homes are the most desirable way to live for most people. It may not be sustainable, but it does make for a more enjoyable life for the people living in them. That's not "fetishizing", that's trying to live the best life possible.

It would be better to acknowledge that rather than being dismissive of it.
Celebrating a nation that doesn’t exist
> Full disclosure format for this report has been chosen due to lack of trust to vendor. Proof of concept code is presented below.
No those people just know how to communicate like a normal human and say hey I'm really not up for it tonight let's reschedule. If anyone replies negatively or aggressively to that they then should find new friends. This is ridiculous
Bash-it: A community Bash framework
The fundamental truth of software. Your system is only as good as its worst component. every. single. time.

Deployment is a component. Monitoring is a component. They are also OpEx and therefore "inferior"
I agree, this app is dumb.

But what's up with getting mad when people don't want to talk on the phone? I don't want to assume but it sounds like you feel entitled to a certain method of communication .
Is there any particular reason to think this won't become another cat and mouse escalation as training algorithms have built in protection against this (and other related training set manipulations, especially the poisoning one the article talked about)? That isn't to say it is useless, as most cat and mouse escalations prove to be quite useful as long as the mouse stays a little ahead of the cat.

In this case, wouldn't such a marker be able to be detected by looking at images of the same class and seeing if there are any common perturbation across them, adjusting the images by the common perturbation , and then training the neural network? Even if there isn't such a common perturbation across them, adjusting them by the false flag common perturbation generated shouldn't be any more destructive than this method would be.

If there was a way to make it dependent upon the initial image and the class, that would be much harder to detect, but would such a method be possible to detect since all images within a class would not have the common perturbation?
In my case, I get a paycheck from my employer as usual. I'm not sure how the specifics work; my employer might pay a premium to a private insurance firm and receive reimbursement from the firm when employees go out on leave so that they're not paying salaries of people who aren't working for them. But at any rate, the cost of providing this leave is similar to other non-mandatory benefits provided by a company (like health insurance), which gets rolled into the cost of doing business and likely gets passed on to our customers.

My wife's leave comes from our state's short-term disability insurance program, which I believe draws its funds from state taxes.
A lot of times those issues have been "fully automated (but with human inputs)" or "fully automated with no guardrails"
The US Govt?
I think it's great we're developing this capability, but I prefer the original-- we're seeing the film as it was originally seen then. The captured scene isn't made better by higher fidelity, it's the opposite for me.

As with most advancements in technology and art, we'll see a proliferation of people using the new technique with mixed results at first. It's the shiny new toy. Then over time, people will figure out how to use it and apply it with intent.

The upscaling projects we've seen in gaming have generally produced spectacular results, probably because the intent in gaming graphics has always been for the sort of pixel density we're finally able to start achieving. Remember the huge disparity between the box art and the game? lol.

Gaming aside, I don't think we've left the toy phase just yet.
That kind of CPU load is a drop in the bucket for Netflix.
In the appendix table, South Oxfordshire is listed as South Oxfordshite.
You don't have to worry about that anymore...

https://www.jumpshot.com/
Show HN: Serverless Bash Template for OpenFaaS
What information is new?

They are still supported in Catalina and they will be unsupported to varying degrees after Catalina, same as they said last year.
Developers who are affected by this (and who were on top of last summer's announcements) knew this day was coming, and have been working on updates since then. 10.15 serves as a testbed that supports legacy kernel extensions as well as the new user-space frameworks (e.g. EndpointSecurity and NetworkExtension) that largely replace the deprecated APIs. Developers that have a revision ready to test against the first 10.16 beta this summer should be in good shape (assuming that Apple doesn't swerve wildly between 10.15 and 10.16 cough 64-bit Carbon cough).

Yes, the documentation is scanty in places, and there is some missing functionality at the moment. And the support burden on these companies, once 10.15.4 ships, will be a pain ("It's OK, the software still works, don't worry about that alert message"). But it is incorrect to say that Apple has not given developers time to react.
My guess would be no, as even the basic use case of a modern charger (for example) requires a functioning computer. Shielding is only a temporary option too because the device could just buffer the data and wait for the opportunity to send.

My guess is, if there is a proof of malicious act, the governments should severely punish the originating company. To act as a deterrent, i.e.: "you can get away with this exactly once".
Right now I use an empty kext to prevent macOS from seizing control of a hardware programmer (keeping it from being accessed by the program that uses it). It was a hack of a solution, but it worked.

This means for the moment, I don't have an upgrade path that works for me...
Which would save HR doing it and sending a memo about health and safety and asthma can kill due to these, possible.... Yeah, that is exactly how that would play out in many companies. At least in the UK.
> Yes, it literally does? https://github.com/systemd/systemd/blob/master/src/nspawn/ns...

No, it literally doesn't. That's just registration with the service manager, and it's optional. Basically it's to make the service manager aware of nspawn's actions, when it's on a systemd host.

I already pointed out they share a lot of code. The service manager process doesn't do squat on behalf of nspawn.
So...Hanlon’s Razor? :)
I wouldn't like a friend which is incapable of communicating.

I can't look at this and consider it interesting, it's not only enabling a toxic behavior, it's encouraging it. I'm actually disgusted by this.

I'm glad I see other people with the same perspective in the comment section as the fact that someone thought about this, thought it's a good idea and implemented it is terrifying.

What happened to "Hey, I don't feel like doing this tonight, let's postpone it?"
I wonder what is the impact of this change.

From my limited experience peer reviews are treated as fairly private communications between the reviewers, editor and authors. We would often use it as an important clue on what to change even if we are going to another journal for publication. This makes the content of the reviews rather sensitive, especially in the cases where there is competition for publication on the same subject.

There are also the cases where Reviewer X may ask authors to do a very specific analysis/improvement that may somewhat benefit their own future research. It's all par for the course.

Another aspect of this that sometimes experienced professors have a fairly good sense on who's giving the review, even though they may be anonymous.

Since this policy gives authors the choice of publishing reviews, I hope it does not degrade the quality of reviews and make people uncomfortable for writing "rude" feedback.
Define "spyware".

JAMF uses the MDM APIs that Apple provides. It also can't access personal data via those APIs. Your anti-virus may use kernel extensions, in which case it will stop working.
If Facebook lawyers understood the implications of LeCun's argument, they wouldn't be happy!

There are two types of explanations here: (1) why did the data come to be as it is, (2) why did my ML make the prediction it did.

Science looks for the answer to (1), and causal models are a great way to think about it. Science and engineering, when they go hand in hand, build a machine by saying "Here is data, let me do science to understand nature's underlying laws, and my machine shall be based on those laws". The machine is inherently explainable because it's based on scientific laws.

In the ML world, we can bypass the "learn scientific laws" part, and jump straight to "build a machine based on data". So the best answer to (2) has got to be "my ML made the prediction it did because of its training data". As Pearl said, ML is just curve fitting, so the only way to "explain" a ML prediction is to say "here are the points that the curve was fitted to". Prediction is just reading a value off the curve. Think the machine is biased? Look for bias in the training dataset! Think the machine is inaccurate? Look for sparsity or conflict in the training dataset!

So the consequence of LeCun's distinction is that, when the GDPR calls for explainability of ML decision making, it is really calling for sharing of the training data. Facebook, watch out!
Duh!

Thumb (or other finger) in ink, ink on paper, done.

Highly resilient to all kinds of attacks. Drop dead simple.

Less is more.
It seems people are kneejerk downvoting you, but maybe the peer review process is a problem. It's worth questioning at least.

Eric Weinstein (for one) has been talking about this a lot and argues that it could be better to work out errors in public, instead of defaulting to consensus.

"The need for verification from others dampens the potential for imagination, which Weinstein believes to be essential for stretching beyond what is currently known to dream the unknowable. This, he argues, is how the sciences actually evolve.

Weinstein points to a 1963 Scientific American article by Paul Dirac in which the theoretical physicist discusses the discovery of a third dimension, itself a revolutionary idea proposed by Newton, and then to four dimensions, as provided by Einstein. Imagination is required to make further theoretical leaps, which might require not listening to present-day consensus.

Weinstein notes that when Crick and Watson published their seminal 1953 paper on the double helix, Nature did not need peer review to allow its publication. "It was an editor's job to figure out if it was worthy of publication." Thankfully, the editors allowed it; that paper revolutionized our understanding of molecular biology. Their work is the basis of all genetic research today."

https://bigthink.com/technology-innovation/eric-weinstein-sc...
> It's sadly very political

This is the predictable consequence of pre publication review by competitors.

The solution is not to hope for better reviewers. It's to abolish the failed peer review system.
What would be the ideal solution to manage fleets of computers though? Afaik Apple does not have a full featured first party solution, or do they?
Fair enough - see my edit above. The only protection against dumb or clever shit is some means to verify SoCs are what they claim to be (yes very hard, but a future with Open source SoCs, and supply chains where you can inspect enough to be confident - that future can be glimpsed from here and it's a future where everyone wins)
"System Extensions and DriverKit"

https://developer.apple.com/videos/play/wwdc2019/702/

From the transcript:

"MacOS 10.15 Catalina will be the last release to fully support Kernel Extensions without compromises." Specifically, for the capabilities supported by System Extensions and the device families supported by DriverKit, using a Kernel Extension to do that same job is now deprecated and a future release of macOS will not load Kernel Extensions of these kinds. In future releases, we will add more kinds of System Extensions and more device families to DriverKit.

In turn, Kernel Extensions of those kinds will also be deprecated."
You are underestimating the amount of domain knowledge needed for this.
Try contributing to open source software which is currently used for research, you'll realize the issue.
Getting Real with Command Line Arguments and Go-Flags