skysight-inc/HackerNews huggingface dataset:
You don't know that, but that's also irrelevant. There's always plausible deniability with such bugs. The point is that you need to catch the errors no matter where they come from, because you can't trust anyone.
This is why I schedule regular one-on-ones with the people I manage, need to make sure I haven't forgotten anyone over the weekend.
Not OP, but a couple of things:

1. For magnetic confinement -- Affordable, extremely high powered magnets called ReBCO magnets have hit the market in recent years.

2. Increases in computing power have made doing the modeling for a new design into a task that can be done in a cloud cluster, instead of requiring a dedicated supercomputer

3. VC's have funded a number of companies to actually start building prototypes.

I'm not qualified to say if it's "for real" this time, but there's definitely new excitement in area.
We now reconcile over $1B per month
> So HN: does anyone have experience working with/for a legacy manufacturer trying to improve their digital ops? Also, what advice might you have for my career path?

I didn't work with a manufacturer, but did work at a real estate brokerage. I worked under the CTO, then the CTO left and I ended up heading the small software department which maintained both internal and external applications.

My advice with that context is that you'll never be the star. Software was a supporting function at my employer and is at yours as well. You need to decide if you are ok with that. The stars at my employer were high performing real estate agents. At yours, they are probably the manufacturing engineers or the salespeople, is my guess. "Stars" are who get the attention, money and focus at the company. (See how hard a time you had hiring a second SE.)

You can make a great living and have a good career not being a star. At the same time, it can be frustrating because you'll always be second fiddle when it comes to resources, recognition and time.

For example, I led the department and there simply wasn't budget for me to hire anyone that I could learn from. There are of course outside of work ways to get better at software engineering, but learning next to someone else at work is a lot more effective and less costly (in terms of time). That's the kind of box you are heading into. You can spend some time learning eng management, product management, and the whole SDLC, but make sure you continue to pull in outside resources, as you can get trapped in the expert beginner mindset, which is no fun and a career dead end.

Anyway, I spent years at that brokerage, learned as much as I could, and then left. Still friends with the team there, but they don't have a real software department any more, almost everything has been outsourced.

By the way, I could of course be wrong and the company could be making a strategic investment in software as a revenue stream, and that would change my advice. I gave feedback based on my read.

Some bonus links:

https://daedtech.com/how-developers-stop-learning-rise-of-th...

https://charity.wtf/2020/11/01/questionable-advice-the-trap-...
My understanding is that it's pretty common for CS departments to get IRB exemption even when human participants are tangentially involved in studies.
I think there's a big difference between sucking your way to the front of the line of qualified applicants for a legitimate job vs jobs that exist simply to be given out for patronage purposes.

IMO getting a job by pulling strings isn't as morally dirty as a job existing for no reason other than to transfer money from the taxpayer to someone with connections.
Can someone explain to me why doesn't he use his existing cash to buy stuff?
A Complete Beginner's Guide to UseReducer Hook
umn.edu submissions are now banned?
It's an idiom. It basically means that someone who committed a lesser, but similar crime wouldn't be able to report a crime themselves.
It does sound like an intentionally misleading name invented by the marketing / PR department of a cloud service provider though. IMHO it would be better to come up with a better name that describes what's actually happening.
Inclusive Transportation Is About Much More Than Lifts and Ramps
The full titre should actually be "Linux bans University of Minnesota for sending buggy patches in the name of research and thinking they can add insult to injury by playing the victims"

> I respectfully ask you to cease and desist from making wild accusations that are bordering on slander.

> These patches were sent as part of a new static analyzer that I wrote and it's sensitivity is obviously not great. I sent patches on the hopes to get feedback. We are not experts in the linux kernel and repeatedly making these statements is disgusting to hear.

> Obviously, it is a wrong step but your preconceived biases are so strong that you make allegations without merit nor give us any benefit of doubt. I will not be sending any more patches due to the attitude that is not only unwelcome but also intimidating to newbies and non experts.

This idiot should be banned from the University, not from the linux kernel.
It varies a lot. A professor I worked for was previously at a large company in an R&D setting. He dealt with 15-20 different IRB's through various research partnerships, and noted Iowa State (our university) as having the most stringent requirements he had encountered. In other universities, it was pretty simple to submit and get approval without notable changes to the research plan. If they were unsure on something, they would ask a lot of questions.

I worked on a number of studies through undergrad and grad school, mostly involving having people test software. The work to get a study approved was easily 20 hours for a simple "we want to see how well people perform tasks in the custom software we developed. They'll come to the university and use our computer to avoid security concerns about software security bugs". You needed a script of everything you would say, every question you would ask, how the data would be collected, analyzed, and stored securely. Data retention and destruction policies had to be noted. The key linking a person's name and their participant ID had to be stored separately. How would you recruit participants, the exact poster or email you intend to send out. The reading level of the instructions and the aptitude of audience were considered (so academic mumbo jumbo didn't confuse participants).

If you check the box that you'll be deceiving participants, there was another entire section to fill out detailing how they'd be deceived, why it was needed for the study, etc. Because of past unethical experiments in the academic world, there is a lot of scrutiny and you typically have to reveal the deception in a debriefing after the completion of the study.

Once a study was accepted (in practice, a multiple month process), you could make modifications with an order of magnitude less effort. Adding questions that don't involve personal information of the participant is a quick form and an approval some number of days later.

If you remotely thought you'd need IRB approval, you started a conversation with the office and filled out some preliminary paperwork. If it didn't require approval, you'd get documentation stating such. This protects the participants, university, and professor from issues.

--

They took it really seriously. I'm familiar with one study where participants would operate a robot outside. An IRB committee member asked what would happen if a bee stung the participant? If I remember right, the resolution was an epipen and someone trained in how to use it had to be present during the session.
Scratching my head, would they do that without a toml parser in std?
I am in this weirdness
. Have they fixed the USB-C PD frying boards issue? That made not buy one so far as an USB-C dock is a must with the Air.
Why not? I meet my friends for lunch and want to send them some photos while sitting in the restaurant?

This seems like a very plausible scenario and most users would not expect and would not want everyone in the restaurant to be able to see their email and phone number.
Thank you very much for your comment. The top page was modified to the word "wtf" by a malicious user. Currently, all JavaScript input forms have been removed from the top page, so I think that it can be viewed normally. I haven't studied enough.
I think Carrier Command (at least the PC version) was not a bootdisk game but a normal .EXE.
This is supremely fucked up and I’d say is borderline criminal. It’s really lucky asshole researchers like this haven’t caused a bug that cost billions of dollars, or killed someone, because eventually shit like this will... and holy shit will “it was just research” do nothing to save them.
Ask HN: Staying interested for more than a year
I'm almost mid-career in IT Ops and am beginning to notice I struggle to stay interested and focused on my career for more nine months to a year at a time. How do you do it?
But that's the point, you're a security researcher wanting to get the honors of getting a PhD, not a petty criminal, so you're supposed to have a strong ethical background.

A security researcher doesn't just delete a whole hard drive's worth of data to prove they have the rights to delete things, they are trusted for this reason.
You won't be able to use this if your file doesn't fit in RAM. This unnecessarily clones the file into a list instead of returning a generator and leaving the list conversion up to the user.
This is an excellent article. Thank you for sharing.

This whole pandemic I've been waiting for us to "get lucky" and find that the virus has some weakness. Like some simple off-the-shelf medicine is a cure. Or that it spreads through some simple mechanism we can beat easily. Or that it can't handle summer. Or that it would never mutate.

Nothing seemed to go our way though.

Then the mRNA vaccines came and that was finally our lucky break! Now thanks to this article I can see that the real breakthroughs came years earlier, from basic researchers. Without these breakthroughs -- which I'm sure didn't excite the public or earn anyone a Nobel prize -- we'd have only inferior vaccines out there.
I've replied to you from an account abbreviated as R.W.
I can clarify one point, relative to migration rollbacks. We indeed chose not to implement down migrations as they are in most other migration tools. Down migrations are useful in two scenarios: in development, when you are iterating on a migration or switching branches, and when deploying, when something goes wrong.

- In development, we think we already have a better solution. Migrate will tell you when there is a discrepancy between your migrations and the actual schema of your dev database, and offer to resolve it for you.

- In production, currently, we will diagnose the problem for you. But indeed, rollbacks are manual: you use `migrate resolve` to mark the migration as rolled back or forward, but the action of rolling back is manual. So I would say it _is_ supported, not just as convenient and automated as the rest of the workflows. Down migrations are somewhat rare in real production scenarios, and we are looking into better ways to help users recover from failed migrations.
IRS chief says $1T in taxes goes uncollected every year
"Holy Grail of surveillance espionage"... maybe the holy grail alarmist statements.

Why are firmware modifications for this "certain" first off?

And what modifications allow this to work as designed without setting off anti-stalking? If you somehow change the ID it's reporting which afaik is a signed value anyways, how are you going to get access to it's location?

If you don't disable anti-stalking then this is no better than run of the mill GPS trackers which can already run for days to weeks
There is a specific subsection of the CFAA that applies to this situation (deployment of unauthorized code that makes its way into non consenting systems).

This was a bold and unwise exercise, especially if you’re an academic in country on a revocable visa who participated.
One theory is about relative movement of old and young. Normal situation, young heathy people move around a lot more than the elderly, contract the virus get immune.

With lockdown everyone is restricted and old and young go to the supermarket and back. As such the elderly are exposed at a higher rate before any level of herd immunity is reached.
Solidstate battery startup – Quantumscape – under attack as a fraud
It means that Prisma will provide a data access layer (we call it "application data platform" [1]) similar to the custom data access layers built by big companies [2] (e.g. TAO by Facebook or Strato by Twitter) that enables application developers to better access their databases.

We've explained that in the blog post here in the "Open-source, and beyond"-section [3].

Does that help? :)

[1] https://imgur.com/O1lwo0v.png

[2] https://imgur.com/Hb9VOWN.png

[3] https://www.prisma.io/blog/prisma-the-complete-orm-inw24qjea...
Back at my first internship circa 2011 or so, we had a developer advocate from GitHub come to the company for a workshop day. He was great. He taught git just like this, and by the end of the day I had a solid understanding of the tool. That background knowledge has remained extremely useful.
Wordpress is horrible to develop for. Look at CraftCMS, a proper CMS architected and built as a CMS. It’ll also help you separate the Wordpress plug-in kiddies from people who actually build websites.

I’ve been building websites for a long time and Wordpress is the most horrible codebase I’ve encountered. I’ll never touch it again. 1-click install to hell.
What an awful existence
How a Korean Company Is Making Money from Animal Cloning
Would you pay over $100K to bring back a beloved family pet? The Korean Biotech Research Company offers such as service via genetic cloning. But despite its high cost, pet cloning is in high demand.
Nuclear Power and Growth
This would absolutely be true if this were an authorised penetration test, however it was unauthorised and therefore unethical.
No, I’m not mixing anything up; I mentioned heat and battery life. Where do I mention performance per watt?
I would actually love a similar (open source) system, that is working cross-platform.

EDIT: I just found snapdrop [1], but haven't given it a try yet.

[1] https://github.com/RobinLinus/snapdrop
Yes, Rust natively can expose C ffi functions (for example).

The https://cxx.rs/ project is also a major crate for C++ interoperability.
If you're a young hacker that wants to get into kernel development as a career, are you going to consider going to a university that has been banned from officially participating in development for arguably the most prolific kernel?

The next batch of "researchers" won't be attending the University of Minnesota, and other universities scared of the same fate (missing out on tuition money) will preemptively ban such research themselves.

"Effective" isn't binary, and this is a move in the right direction.
I'm a huge fan of the lightweight nature of Cusdis.

I made this walk-through video of the project inclusive the deployment to Vercel and Railway:

https://www.youtube.com/watch?v=XHr0oBIA2xA
I would highly recommend anyone interested in pentesting smart contracts look at the work Trail of Bits has been putting out: https://blog.trailofbits.com/?s=smart+contract&submit=Search

Start with "246 Findings From our Smart Contract Audits: An Executive Summary" [1]

[1] https://blog.trailofbits.com/2019/08/08/246-findings-from-ou...
Maybe you're not Xer, but you're definitely "being employed by X", just because your company may have to same fancy naming due to its name does not change anything
One explanation is that Apple has sat on this for 2 years, knowing this is a serious security bug. Another explanation is that they just don't think it's that serious. The article states-

> The discovered problems are rooted in Apple's use of hash functions for “obfuscating” the exchanged phone numbers and email addresses during the discovery process. However, researchers from TU Darmstadt already showed that hashing fails to provide privacy-preserving contact discovery as so-called hash values can be quickly reversed using simple techniques such as brute-force attacks.

The post that they then linked to is about how, by hashing random phone numbers, you can effectively de-anonymise users of popular messaging apps.

So you'd need to be in physical proximity to the person, and what you're getting is details like your phone number which aren't especially private anyway (they literally need to be given to people to be of any use). It's far from the dragnet-level issue facing Signal & Whatsapp and others.

I don't know, but that doesn't seem like an especially serious issue to me. It seems just like a research group trying to make some hype for themselves.
Thank you for your comment. The site I searched for was "http://url-wiki.com", not a note. I posted an article on how to use it in note, and I thought it would be easier to understand, but I'm sorry that it confused Hack News.
Patches with built-in bugs made it to stable: https://lore.kernel.org/linux-nfs/YIAta3cRl8mk%2FRkH@unreal/.
If they use a different email but someone knows they work at the university?

It's a chain that gets really unpleasant.
I'm not sure it is experimenting people without consent. Though it's certainly shitty and opportunitstic of UoM to do this.

Linux Bug fixes are open to the public. The experiment isn't on people but on bugs. I would be like filing different customer support complaints to change the behavior of a company -- you're not experimenting on people but the process of how that company interfaces with the public.

I see no wrong here including the Linux maintainers banning submissions from UoM which is completely justified as time wasting.
There're still faster approaches than naïve and probably common "copy valid byte sequences one by one into a resizable result buffer". For instance, scan through the input bytes all at once, keeping track of position and length of valid sequences, then memcopy each valid sequence into a preallocated buffer.

Edit: Although, it looks like Rust's std already does this, except for preallocating an exactly correct size result buffer: https://doc.rust-lang.org/src/alloc/string.rs.html#538
Why Facebook won’t sell ads in its planned Instagram app for kids
I’m aware of the difference just wondering what benefits people have found. Catching == versus === is a good one.
The student doubled down on his unethical behavior by writing that his victim was “making wild accusations that are bordering on slander.”

You can’t make a silk purse out of a sow’s ear.
Well, for example it can be countered by offering all young men from these regions jobs outside. For example, in the military, creating a large mobile military force recruited from these regions for operations in say, Afghanistan, offering them good pay and discouraging them from returning - and encouraging people from other regions or countries moving in their place (for example by lowering barrier of entry for immigrants as long as they are going there, or increasing otherwise) - until "locals" become a minority and their social connection networks disrupts or become irrelevant.

This mafia thing is definitely cultural - "it is the way things are done there" - so it can be fixed by replacing/diluting people.
Nix in Production
Making sense of what’s going on in the housing market
Cool! Hadn’t heard of that before. Here’s a link for the curios: https://www.pcworld.com/article/3398919/quake-ii-rtx-on-a-ge...
YouTubers List
I played with some BLE beacons a few years back. I honestly didn't find them very useful for finding things--though that was probably some older Bluetooth version.
The professor's site says that he is an assistant professor, i.e., he doesn't actually have tenure yet.
Text messages were around €0.10 for most plans until 2012 though (due to the unlawful collusion of telcos).
Not to be picky, but what are the advantages of using CL for this kind of software instead of Julia?
> Go set up a test, and notify the people.

The vulnerability is in the process, and this was the test.

> You really think the Linux kernel guys would change their process if you did this? They'd still do the same things they do.

If they're vulnerable to accepting patches with exploits because the review process fails, then the process is broken. Linux isn't some toy, it's critical infrastructure.
DNA of giant ‘corpse flower’ parasite surprises biologists
Seems like Apple completely ignored that inside a country the first three digits are guessable and the hashed string has a defined length, which makes hash cracking a lot easier.
What Does a Dent Repair Service Entail?
Dent repair in Toronto is a necessity for any car owner. Therefore, knowing what to expect from a professional service is also necessary. There are many ways to repair dents including paint-less options and major dent removals that require extensive dent-work to fix.
The implausible part is not having lunch with friends, although the pandemic has made that feel less plausible than it used to be... but rather, having an attacker actively running an attack within 10s of feet of your table at the restaurant. What is your threat model that makes this plausible?! You must be super important to have attackers following you to lunch. Or maybe you like to eat at restaurants that do their best to harvest all visitor data, even going so far as to use cutting edge vulnerabilities?

The person you replied to literally said this should be fixed. I agree with them that this is nowhere near as serious as issues Apple has had before, since the attack requires physical proximity and the use of the share pane. Even then, it doesn’t give the attacker RCE privileges or anything similarly world shaking.

Should Apple fix it? Again, absolutely. No one has said otherwise.

Nothing is 100% secure, so the relative risk posed by vulnerabilities can only really be assessed with a threat model. In most threat models, this is nowhere near as bad as their “GOTO Fail” bug or any number of others over the years.

I think celebrities and VIPs are essentially the only ones whose threat models would actually be impacted by this vulnerability in a plausible way.
Make an ethics complaint with the state and get their certification and charter pulled.
Or just "Linux bans University of Minnesota for sending malicious patches."
That's a great point. In that particular case, there was also the matter of a Facebook users unknowingly having the ability to share not just their own data, but data about their friends to a third party.

In our case, a car owner can link their car to a app of their choice. It's a lot like how you can link your bank to an app like Venmo or Robinhood. We do vet all businesses using our APIs, but a data/security audit of customers seems challenging and uncommon.

Are you aware of any services that help facilitiate this or any platforms that do this today?
Exactly. It is sooner than you think.

You won't be the M1 early adopters in 2020 that had their software break in front of them this time when getting an M1X or M2 device this year.

Not only it will be a lot faster thanks to it being possibly going down to 4nm, the software ecosystem will be much improved and supported by it from day 0.

You will thank me later.