skysight-inc/HackerNews huggingface dataset:
No way, exactly the opposite. Attacks are often described as "chains" because it usually requires simultaneous application of multiple exploits to achieve an attack's goal.

Here are a bunch of great real-life examples from the Playstation 4 hacking scene: https://www.psdevwiki.com/ps4/Working_Exploits

Or iOS exploit chains, some of which I've used intentionally as part of iOS jailbreak tools like unc0ver. From Project Zero's "very deep dive into iOS Exploit chains found in the wild": "Earlier this year Google's Threat Analysis Group (TAG) discovered a small collection of hacked websites. The hacked sites were being used in indiscriminate watering hole attacks against their visitors, using iPhone 0-day."
https://googleprojectzero.blogspot.com/2019/08/a-very-deep-d...

I imagine the real-world application of this MSI thing is something like:

1) Get silently-malicious MSI on to target machine (via download server compromise, poisoned non-TLS download, redirect TLS-downgrade, etc etc)

2) Got malicious "trigger" exploit code on to any web page used by the target (via web server compromise, weak human security like admin passwords, etc etc).

3) There is no step three.

With this in mind we can look at even very recent real-world news—like the simultaneous patching of five Chrome exploits in June 2020—and instantly see how it's not just hypothetical:
https://www.cisecurity.org/advisory/multiple-vulnerabilities...

For example, one of them (CVE-2020-6493) is "Use after free in WebAuthentication in Google Chrome prior to 83.0.4103.97 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page". How many more of these do you think are hanging around out there, waiting for Google to get the 'okay' to fix?
The Google letter pretty clearly makes overtures about "threats" to their free services.

"Nice free search you got there. Shame if something were to.. happen.. to it."
Since selling its Intel server business to Lenovo, IBM enterprise server hardware is Power only. It is the flip side to some of the complaints in this thread, IBM enterprise sales is the single trusted source (or single throat to choke) for all of your business critical systems.

If your organization has an existing relationship with IBM or Red Hat, Power CPUs are part of an integrated bundle moving forward.
This kinda explains it: https://notepad-plus-plus.org/news/v789-stand-with-hong-kong...

It's an obvious attempt for censorship :)
> I don't think Google actually made either of these claims in their letter.

Agreed. And because this ACCC response doesn't link to the letter, I think these rebuttals to non-existent claims are deceptively misleading
Notice that in the example the field 'H' has much higher probability to contain a mine than the fields 'I' and 'F'. This can be very unintuitive. The reason is when counting configurations one needs to consider the placement of all the mines, not only the ones that have a neighbour uncovered. When this is considered then there are (76 choose 6) configurations that have a mine on 'H' and (76 choose 5) configurations that have mines on 'I' and 'F'. (76 choose 6) is a much larger number than (76 choose 5).

In general I found that in a normal game when a guess is needed then it's better to guess for configurations that have fewer number of mines on the perimeter of the uncovered area, as they have higher probability.
>exempt themselves from searches via the sitemap.xml file

Nitpick: you mean meta noindex and/or robots.txt
This media release is confusing.

It was almost as if somebody said you need to put out a press release so find something to put in it, rather than we have something really important to say so we must put out a press release.

Who is making these decisions?
True, and I absolutely support regulation where necessary. I strongly support regulation that require companies to handle user data in a confidential manner, for example. But that doesn't make all regulation automatically good; I strongly oppose regulation that requires companies to share sensitive user data with anyone who asks for it, for example. And forcing a company to do business it does not want to do, seems unreasonably oppressive.

In this particular case, if Google barely makes any money on linking to news sites, and the law says they need to pay a lot of money to link to those sites, then the obvious business decision is not to link to those sites at all, which will likely hurt news sites, because they get less visitors.

There are levels of regulation that will hurt the market, rather than help it, and this sounds like it might be one of those.

I recognise the right and need of democratic governments to regulate markets, but I also recognise that this can turn the government into an authoritarian seat of power, that serves power, rather than the people. This democratic accountability needs to work, needs to be used, needs to be obeyed by the government. So that makes it good that Google shares with the Australian public what's going on.
I wonder if the fact that we now can't trust anything we read is good or bad. Maybe it'll lead to critically thinking about everything.
Yeah, but "Open" isn't everything.

1. Is any of these "Open" architectures actually used in production anywhere serious when not implemented by their creators? I'm actually interested to know of examples.

2. How do we know that the actual chip IBM provides is the thing in the spec? The comparison was with Intel, how can we prove that there are no backdoors for PowerPC? If we can't prove, does it matter if it's "Open"?
Before I have a chance to study abroad, I never saw snow at all. Flying to the other side of the globe is more than a vacation for me. It was like a trip to gain the experience, the perspective of many interesting cultures.I do agree though that train in Europe and some country is so good that you can avoid the flight.

Maybe, because I was born and lived here in SouthEast Asia. Almost no one in my circle or news outlet here talk about avoiding travelling by air. Every national holiday here, you can expect to see people crowded at the airport.

I do understand that traveling by air has higher cabon emission, but I think the experiece and perspective you gain from travelling make you understand the world better.

I do hope we can come up with sustainable alternative of air traveling soon.
Well, you can just write an installer that uses an elevated cmd anyway. I think conemu does that? (not sure, maybe it is another software)

Is unsigned software subject to further restrictions by default compared to signed but "unknown" software (sometimes a pain to use with Defender)

And I kind of remember there was already other bugs with MS code signing checks? (not sure)

I agree this bug probably breaks the (informal/perceived?) security model of some hardened configuration, but that kind of hardening should not be considered completely sound anyway. It's like the UAC that is not to be considered a security boundary, yet somehow useful against casual threats or even just errors.

If you download and try to execute random code, you should consider it will be executed regardless of the expected checks and perceived hardening of your system. And you should consider that your OS is full of security bugs absolutely everywhere. Your web browser too (yep, that means JS is an insane threat now).

Not really a reason to not fix that kind of things though, but nothing serious enough to loose our mind.
Spectrum Analyzer Software for OpenRAMAN
Vultr Network Outage in AMS
No, because the attacker renames the file to .jar before sending it to the target.

Windows still sees it as a MSI file while doing signature checking. But because it has a .jar extension, the JRE runs it when you double click.

Signature verification is done as a independent check, completely separate from execution. Because windows needs to know the signature is valid before even allowing the file to be executed. It also needs to show the signature check in the right-click -> properties dialog.
>conspiracy theories that too many paid commenters are among the crowd here

I think HN just has a large pro-google crowd. I remember it used to be everyone loved google. So it shouldn't be a surprise that one of the remaining bastions of google public support would be a silicon valley startup community.

I suspect a lot of people outside Australia are unaware of how respected an institution the ACCC is. Maybe that is why they are so quick to discount their response here.
People brazenly come into my Starbucks all the time and openly announce they are shoplifting, because they know that the police won't show up to take a report for at least an hour.

Once we do have the report, even if they do get caught, nothing happens. Many months of reports and multiple trips to the courthouse and we can MAYBE get a stay away order. Usually before that point, the store management has shuffled around enough that the person handling the legal legwork has moved on.
You can damage open/federated email without having to break the lower level layers. See winmail.dat for instance[1].

I don't know if it's still in the pipeline but I remember that Google proposed
an "AMP for email" not so long ago, with basically self-updating email contents.

Open email can be severely damaged if good old SMTP is only used to tunnel
proprietary formats, especially if those formats are effectively just metadata
that's used to fetch the actual content of the email from 3rd parties.

[1] https://en.wikipedia.org/wiki/Transport_Neutral_Encapsulatio...
The Power of Free
From the ACCC's own release:

In addition, the platforms must give news media businesses clear information about the data they collect through users’ interactions with news on digital platforms; for example how long users spend on an article, how many articles they consume in a certain time period, and
other information about user engagement with news content across digital platform services.[1]

Sure sounds like they have to collect and share user data to me.

[1] https://www.accc.gov.au/media-release/australian-news-media-...
I believe HBO Chernobyl used Ignalina as a filming location.
> I hate the way Google says they want to keep user data safe, while also using that data to increase their ad revenue

Yet, from the perspective of many users, this is keeping their data safe. Many people I know are completely fine with advertising. In terms of keeping data safe from being lost, leaked, or hacked, I think Google is probably one of the safest places out there.
Are you kidding? Or is it corporate speak, like "it does not block Tor, only 99% of its users"?.

Cloudflare is what makes the web unusable for Tor users. Every two websites you try to reach, yup, blocked by Cloudflare. The fact that you try to deny it makes it painfully obvious how there is no hope for Cloudflare. Sorry, I can't wish any good to your company.
It can be hard, TBH - I actively minimize distractions anyhow, but this is on a different level. It's probably not for everyone.

That all said, statistically I'm much more likely to be awake than not during the day, so many folks would have no idea. Usually there's only one day a week where I'm essentially going to sleep right when everyone else is starting their day.

I'm lucky that my daily shift is 3h - two REM cycles - as it maps nicely onto the 24h schedule everyone else is on, most of the time. 1.5h or 4.5h would be really confusing to me.
https://news.ycombinator.com/item?id=24185626 :)
To be eligible for the scheme, the proposed bill requires annual revenues of at least[0] $150,000 (amongst other things), so I imagine it would exclude most independent-journalist-running-a-blog situations

[0] see section 52G of the draft bill - https://www.accc.gov.au/focus-areas/digital-platforms/news-m...
This is why zero-days should be made public a week after reporting them to the company...without ANY fear of prosecution.
Trust me, after the first 50 cases - the companies will have a dedicated team working on such exploits.

Wow, they made this public and MS still didn't handle it...I guess it should be more widely advertised then.
On the other hand, the government is a true monopoly (for good reason) so you can't just stop being their "customer" whenever you like.

You may end up spending your entire life oppressed by your fellow citizens who may be indifferent towards your needs.

So I think there is a good reason for not having the government directly run everything. It wouldn't even mean democratic control over everything. It would mean bureaucratic control, very indirectly influenced by a democratic choice between a handful of parties once every 4 or 5 years.

Both government and voluntary agreements between individuals and companies have their place. What governments should do is make sure that our interaction with Google and other tech giants is indeed voluntary and transparent.
Ask HN: Its dreadful to use TeamForge CoreALM task management
My company, an automotive supplier, recently transformed us all to use CoreALM from TeamForge as task management tool. To my surprise the web interface of CoreALM is so dreadful, the searching option, Kanban views and many other features feels like I've been pulled to very old age software. I'm spending more time on tool instead of doing my task management. Maybe I'm expecting unnecessary stuffs in the industry CoreALM serve. Have any of you using it? How do you feel?
I have actually been repeatedly surprised at how sane the temperature measurement on my car is. It'll be sitting baking in the sun, then I get in and swelter, but the measurement is actually really close to what was forecast. Sometimes, I then drive off, only for the measurement to actually increase by a degree or two as I head into a different microclimate. If it was significantly affected by the greenhouse heat of the car body, it would decrease as I drove away, due to increased airflow. I don't know where they put the sensor, but I think they got it right.
Google is totally in the wrong here, and ACCC is doing its usual good work of protecting the Aussie consumer. It's interesting to watch Google try to squirm out of this though - they probably see it for the precedent it is.

Google relies heavily on third-party content that they don't pay for in search results. If this law forces them to negotiate payment for that practice then I'm all for it.
I'm very curious how this law wouldn't violate various free trade deals Australia has struck.

Surely a tax that explicitly names only foreign companies is the opposite of free trade?

Sure, China has driven a truck through the whole concept of the WTO over decades and so I doubt anything will happen. Free trade deals are very much toothless, on the assumption that they are supposed to make sense on their own terms so enforcement is not required. But I can see the USA especially if Trump wins a second term deciding that Australia should be trade sanctioned for discrimination against US businesses. The White House won't want to see tech firms become piggybanks for failed industries and economies around the world.
New deep-threaded platform that unifies messaging and business processes
Hi all! We launched deep-threaded platform Leverice that unifies messaging, collaboration and business processes. Leverice helps to coordinate a multinational team developing an advanced space project. The well-thought-of features, the intuitive workflow, access to complete messaging history for free all the time make Leverice helpful platform for distributed teams. We're asking for your feedback about Leverice. Feel free to share your ideas and thoughts with us.
GraphQL Server with, TypegraphQL and mikroORM minimal boilerplate
I can appreciate how it might sound unsane if you've never dealt with sleep issues (jealous!) or read a ton about it. Ask away, but I did cover a bunch of these elsewhere in the thread: https://news.ycombinator.com/item?id=24185624
Thanks sjy
Ask HN: Simple server metric monitoring tools?
Is there a simple server metric monitoring tools which does not need to configure a lots.

What I mean simple is, just want to set how much CPU%, RAM% and Disk space usage and when server got over that percentage then create alert.

Is there simple tool like this? I saw once on HN and now I can't search it back.
What about criminal liability? I know that it's highly unlikely that Microsoft will ever get what it truly deserves (at least as long as the USA remains what it is), but still.

I find it rather telling, how many argue that Microsoft is (obviously) wrong in their behavior, yet I don't read much about how the company deserves severe punishment (maybe even forced break-up or having control taken away from it altogether), for knowingly not fixing a security fuck-up like this, for this long. Maybe an interesting case for anthropologists one day, to study social/cultural conditioning.

I'm sure that Microsoft will have it's reasons and considerations, but that should not excuse or exclude them from liability for the consequences of their actions. Whether that will ever succeed in court, given both the reality of what Microsoft and the USA are (many other countries too, by extension), that is another story. But it should not take rocket science to figure out that it will only get worse if Microsoft gets away with this without repercussions (again). Guess, how we got here in the first place.
HDBSCAN is truly a mighty clustering algorithm & nice work! https://towardsdatascience.com/lightning-talk-clustering-wit...
Hadoop is a collection of things: HDFS (filesystem), Hbase (keyvalue database), MapReduce (data processing), and YARN (resource scheduling and job management).

Hbase was open-source implementation of Bigtable while HDFS was a copy of Google File System. The divergence appeared with other processing frameworks like Spark but now there's Apache Beam to unify it all.
I've been using my Freerunner for over 10 years. I've tried it with a bunch of distros (including the first version of Android when that came out, which was nice but sluggish); I've generally stuck with QtMoko (although that was last updated in 2014).

The battery struggles to hold much charge any more, so I've been waiting for a replacement which isn't a "freedom downgrade". These newer offerings are exciting, but seem a little too beta for me to switch quite yet.
You could've chosen a better example of "content producers for the open web" than lyrics websites. Musixmatch didn't write Money For Nothing.
> but “Open” isn’t everything

I never claimed it was, and this is starting to reek of a straw-man argument where you’re opposing a statement I haven’t actually made.

(1) Yes, I am aware of situations where this architecture has been chosen by a body that isn’t a chief implementor, and no, I am not at liberty to discuss it.

(2) Having an open spec to compare against, even though I actually don’t know how, is already another plane of existence compared to not having something to compare against.

Decapping and microscopy? Pushing edge cases onto the chip and comparing expected outputs? Implementing all or part on an FPGA and seeing how they compare at a severely clock-reduced rate? It’s well beyond my technical ability, but it’s not beyond expert technicians’ abilities. That’s the key point.

EDIT: Also you can set your own keys for the root trust, and remove others’. That’s very important, and radically orthogonal to the competition of ARM and x86₆₄.
> without using a different vulnerability to invoke the JRE on the file

Funnily enough this is exactly how real attacks tend to work https://googleprojectzero.blogspot.com/2019/08/a-very-deep-d...
That is a most excellent response, and I agree with everything you say, including how and why that bit comes across nastily. Ta for that, I really must learn to be less of a tosser.

> rare young person trying to be an achiever you can almost be sure he's mocked and bullied by his peers

Yes. Someone on the web (maybe here, maybe slashdot) said that when someone tries, they're seen as trying to get above their station. Consequences follow.

I spent a couple of years on a sink estate in the UK as a kid. I know what it does to people.
Just to elaborate since there is some confusion about when the name would occur.

1) Take MicrosoftSigned.Msi

2) Append Malway.jar to it

3) Take file and rename it as RunMe.Jar

# Now you have a jar file that appears to be signed by Microsoft but contains malways.

4. Give target RunMe.jar and ask then to dbl-click it.

# Usually this file would prompt the user with a "You shouldn't trust this arbitrary file from the internet" prompt, but it doesn't because Windows thinks this file is correctly signed

5. Target is now infected
Reminds me of the "Induc" virus.

This virus infected Delphi installations, injecting its code and compiling it into a system library. All programs using the infected library contained the virus, including some popular ones.

Because they came straight from the developer, and the virus didn't do anything unless you had Delphi installed they were often considered false positive when they weren't. Originally, it had no malicious payload beside its replication mechanism.
If you don't mind online scanners (drag & drop), then perhaps:
virustotal.com
virusscan.jotti.org
It’s also subject to frequent corruption and conflicts in them are irritating to solve.

+1 to Bazel - though it’s best suited for monorepos where you are building completely from source.
Thanks for the feedback! We have plans to create a tutorial soon and run it virtually during SPLASH/ECOOP'20 [1] (I have to check why the tutorial page is no longer public).

[1] https://web.archive.org/web/20200319123703/https://2020.ecoo...
Why would it be a net loss to australia or any other nation if they instead just developed search engines locally? Is search really so impossible that only in America can they can possibly get enough talent to do web search?

At a time when Australia is wanting to expand it's technology sector, seems like a simple solution if google just leaves and it's replaced by an local company that is willing to pay its fair share.
HTML is also "going strong", that's not really the problem. The proprietary
takeover happens at higher layers.

If SMTP is only used to tunnel proprietary content à la winmail.dat, it doesn't
really matter that it's still technically open.
> Sure sounds like they have to collect and share user data to me.

This seems to be aimed at AMP. News sources get any information that google collect about users reading the articles. Seems fair.

Google could always not collect that information in the first place if they wanted to actually take the moral high ground. But of course they won't do that.
It seems that the first "half" is just an introduction and setting of context for the second part. It worked out quite well for me, but I found the wording a bit too verbose and philosophical at times.
Thanks for sharing. An explicit revenue minimum... incredible how blatant this legislation is. Not about supporting journalism at all.
The Swedish Staycation Obsession
Weekly Robotics #104
That was a fine for breaking the rules, not an involuntary contract.
The issue is that the ISM is incredibly thing. So it's one of those multiple incredibly large by incredibly small number cases and intuition doesn't work, you'd have to do the actual math. I.e. the timescales could be large enough that if some process could create such an object they could still cross between galaxies.