skysight-inc/HackerNews huggingface dataset:
This is an app I developed after being frustrated with the official SecurID app from RSA. My work requires that we use RSA SecurID for 2FA when logging in (which is required much more in the WFH world).

2FA tokens can be viewed within the app, on the iOS home screen and as Apple watch complications.
"When an asset class becomes so popular that people who have no idea how it works are putting money into it and loudly campaigning for others to do the same that is a sign that you are in a bubble."

It absolutely isn't a sign a of a bubble. There aren't many people that understand what they are investing in be it currency or Google.
The success of the investment has nothing to do with the cabbies understanding. Taking his advice does.
exactly what I thought, there is a lot of accounting, tax and legal things to consider when contracting.
That is just a matter of social convention.

We could all agree that corporations should be socially run and football clubs should be private corporations.

People are saying that football clubs are rooted in society in the very same country whose leader once said “There is no such thing as a society”.

The world is what we make of it.
>the point of this "research".

I think it's mostly "finger pointing": you need one exception to break a rule. If the rule is "open source is more secure than closed source because community/auditing/etc.", now with a paper demonstrating that this rule is not always true you can write a nice Medium article for your closed-source product, quoting said paper, claiming that your closed-source product is more secure than the open competitor.
No, it's totally okay to feel sorry for good, conscientious researchers and students at the University of Minnesota who have been working on the kernel in good faith. It's sad that the actions of irresponsible researchers and associated review boards affect people who had nothing to do with professor Lu's research.

It's not wrong for the kernel community to decide to blanket ban contributions from the university. It obviously makes sense to ban contributions from institutions which are known to send intentionally buggy commits disguised as fixes. That doesn't mean you can't feel bad for the innocent students and professors.
It does raise questions though. Should there be a more formal scrutiny process for less trusted developers? Some kind of background check process?

Runs counter to how open source is ideally written, but for such a core project, perhaps stronger checks are needed.
It's indeed unfortunate what a few bruised egos will result in.
I think we've cracked general AI if an operating system is being quoted on the front page of HN.
The Librarian’s Copyright Companion Goes Open Access
Yes - managing relationships, uncertainty, tough to get started, lack of continuity and very different career progression, a lot more work in general - none of those are appealing.
It really wouldn't have and would've made the patches not pass all levels of review.
Well, this was a good few years ago now, but I sure they DID want 100% charge anyway!
AWS CloudWatch vs. Dashbird
https://www.politico.com/states/new-jersey/story/2020/08/13/...
I'm not a kernel developer so I don't understand the details of this part:

>People forget that only a few years ago have we decided that the kernel now has to protect userspace programs from malicious hardware. That's a major shift in thinking, now data that we used to blindly trust can not be trusted at all.

How come this wasn't being done already? Wouldn't you want drivers to do safety checks on everything, in case of a hardware failure? Or does this refer to something else, besides safety checks?
Yes, I wonder the same... The wikipedia article points to landlordsgame.info. Thereyou can also see a picture with all the cards and chips that came with it. It seems a lot. But there is no complete, printable copy of them: http://landlordsgame.info/games/lg-1906/images/lg-1906_egc-p...
Hi
We have been collecting this library for a long time. Regarding legality, we hide the documents of those manufacturers who do not want to publish them. But there are very few of them.
Patagonia cuts ties with tech bros
Tradition is typically pretty bad at keeping up with innovations.

It's very European to cling to what was done by their ancestors rather than adapt to change. European exceptionalism has been dead since WW2/end of the cold war, and with technology we get to witness how the citizens are handling the transition.

You can find parallels with European Food and Products. It's 2nd place stuff.
Agreed on the time issue—as I noted above. I think it's still of a pretty different cost character to actually allowing malicious code to make it to production, but (as you note) it's hard to be sure that this would not make it to some non-standard branch, as well, so there are real risks in this approach.

Anyway, my point wasn't that this is free of ethical concerns, but it seems like they put _some_ thought into how to reduce the potential harm. I'm undecided if that's enough.
> the strength of open source is its auditability, thus such bugs are quickly discovered and fixed afterwards

That's not true at all. There are many internet-critical projects with tons of holes that are not found for decades, because nobody except the core team ever looks at the code. You have to actually write tests, do fuzzing, static/memory analysis, etc to find bugs/security holes. Most open source projects don't even have tests.

Assuming people are always looking for bugs in FOSS projects is like assuming people are always looking for code violations in skyscrapers, just because a lot of people walk around them.
Factorio has plenty of bugs. If you don't take precaution, they'll wreck your factory too.

Or if you want an easier experience, you can turn enemies off, I guess.
Ahhhhhh. I was daydreaming this the other day
Suspected Actors Leverage Authentication Bypass and Pulse Secure Zero Day
Well there is always the is-ought problem. And we get around that via social consensus. There was nothing really wrong with the super league idea from a pure capitalist perspective.

In fact according to neo liberal capitalist logic this is the best way to run anything including football.
You can only burn a little since:

1.)If you burn too much the whole pricing and ordering mechanism for operations does not work any more. Burning is only going to lead to big players in mining/staking and consumers making direct side arrangements.

2.) There is less incentive to stake since burning benefits all regardless if you stake or not. Its essentially a stock buyback. But sure you still have the inflationary block generation as rewards.
In 10 years after that war, Chinese military bases in Moscow, Minsk and Paris will ensure European co-prosperity sphere and harmonious development on the continent.

Seriously - you want to risk hot war between Europe and Russia with millions in collateral losses because Lukashenko put a few dozen people in prison and single digit number of people died in protests? Do you also advocate machine gunning jaywalkers?
The candy comparison is wrong on two levels.

1) Unless you exclusively run software written by close friends both Linux and $ClosedOSCompany are equally "outsiders"

2) I regularly trust strangers to make medicines I ingest any fly airplanes I'm on. I would not trust any person I know to fly the plane because they don't have the required training.

So, trust is not so simple, and that's why risk analysis takes time.

> There's no reason they have to trust you and (say) Microsoft employees/Apple employees/Linux maintainers equally

...and that's why plenty of critical system around the world, including weapons, run on Linux and BSD, especially around countries that don't have the best relations with US.
This probably needs a better title (currently— Linux: Dont get me started on “executives”). Maybe, “Linux Needs Executives to Increase Priority of Bugfix Development”. As it stands the title doesn’t give the reader much of a clue about what the post is about.
Saying this, it's not a literal line of course, but a meaningful strategic objective, and rough position for offensive staging.

Yes, yes, yes. Long lines on warfare are an invitation for a breakthrough by a more concentrated force, which is what every Russian military textbook tells.
I'm completely perplexed at some of the functionality that's absent in Prisma? I'm coming from the Rails/Django world for reference. Can anyone help me understand if I'm out in left field or does this technology only cover basic use cases?

- No supported way to do a case-insensitive sorting. https://github.com/prisma/prisma/issues/5068
- Can’t sort by an aggregate value like user’s post count. https://github.com/prisma/prisma/issues/3821
- Can’t control between inner/left join.
- Can’t do subqueries.
- Migration rollbacks are experimental maybe unsupported now? At least I only see mention in Github issues and not in the docs.
- Transactions appear to expect a series of queries? It doesn’t look like you can execute any app code during a transaction?
- No support for pessimistic row locking e.g. SELECT… FOR UPDATE ?
- No way to mixin raw query partials like `where('name ILIKE ?')`. You either need to write the whole query raw or not.
- Validations are done at the database level.
- Complex validations seem tricky to write in this format
- No built-in way to make clean user-facing validation messages.
- You can’t check that a model instance is valid without just trying to insert it into the database
- The official documented validation example has you connecting via psql and adding a constraint?
- So following the offical example my validations aren’t documented in the codebase via a model or a migration?
- Also they don’t have a validation example documented if you’re using MySQL instead of Postgres?
- Cascading deletes are handled the same way as validations. As in Prisma basically does nothing other than document how to implement it yourself outside of the library.
- No model methods. I guess that's not a surprised because it's "not an ORM". A model really is just a data mapping? Anyways it seems like you would end up rolling your own wrapper around this and there's no recommendations on standardized architecture.
- No callbacks. These have been controversial at times so are teams using Prisma writing something akin to "services" instead?
- Syntax nitpick but one of these is vulnerable to a SQL injection and it seems really easy for a new developer to get mixed up?
- prisma.$queryRaw(`SELECT \* FROM User WHERE email = ${email}`);
- prisma.$queryRaw`SELECT \* FROM User WHERE email = ${email}`;
- No way of batch loading like Active Records’s find_in_batches / find_each. All objects are just loaded into memory?
- No way of hooking into queries for instrumentation. e.g. ActiveSupport::Notifications.subscribe

FYI - This is after fairly brief research. Not guaranteed 100% accurate.
IEEE S&P is actually one of the top conferences in the field of computer security. It does mention some guidance on ethical consideration.

> If a paper raises significant ethical and/or legal concerns, it might be rejected based on these concerns.

https://www.ieee-security.org/TC/SP2021/cfpapers.html

So if the kernel maintainers report the issue to the S&P PC, the paper could potentially be rejected.
> You would not have been approved for a passport, if deemed unworthy.

Do you happen to know me in real life? How do you know if I'm worthy or unworthy to the Chinese state?
Apple generally does it right. And especially since Tile harasses you to buy a subscription in which they use your phone to report others devices locations. So you think Tile did it right? I’m counting the days myself.
Many of the fans objecting to the ESL also object to extortionate TV fees. Many still object to the formation of the English Premier League and the associated 'capitalisation' of football. If you only watch football on TV then, sure, things like the ESL will have far less of a direct impact on you.
Thank you. We'll fix this problem asap. Fixlib was the temporary name. But we decided not to buy this domain.
Author of the post here. Thanks for the link; added it to the post in the "Notes" section.
> Playing the devil's advocate

I think my employer will only pay for one more comment :)

I agree, but most things in life are social conventions. The problem is not identifying them, but changing them.
Malicious and failed at not the same thing.
As a non-native speaker, I always found the term "executive" for managers somewhat strange. Why call someone who doesn't actually execute anything "executive"?
Renaming a column is an operation which showcases the weakness in not using an ORM. Other operations of the sort do exist, anything that operates on columns across multiple arbitrary spots in the code.

IMO an hour for a change you have so little confidence about is not acceptable when the alternative allows you to do it in a second with full confidence.
Take the tag off the bag? Surely you can work that out for yourself whilst dreaming up these ridiculous edge cases to prove some point?
Tile charges for that feature, and harasses you in app until you pay the sub. Tiles only works with phones, any apple device supporting the “find my” protocol can report the position of a tag.

Integration into the Apple ecosystem is another huge one that Tile refused.
As long as the enemy has an actual valid claim.
This is bullshit research. I mean, what they have actually found out through their experiments is that you can maliciously introduce bugs into the linux kernel. But, did anyone have doubts about this being possible prior to this "research"?

Obviously, bugs gets introduced into all software projects all the time. And the bugs don't know whether they've been put there intentionally or accidentally. Alls bugs that ever appeared in the linux kernel obviously made it through the review process. Even when no-one actively tried to introduce them.

So, why should it not be possible to intentionally insert bugs if it already "works" unintentionally? What is the insight gained from this innovative "research"?
You and the MSM will have to repeat that for quite a long time if you want it to eventually be true.
Custom EDM Machine Build Video Series
At least you have to give Apple credit for using a simple standard CR2032 battery this time and not "inventing" some non-standard format such as 19 mm. Or even creating tad larger cell with an integrated id-chip that validates that the battery is manufactured by Apple.
Who funds this? They acknowledge funding from the NSF but you could imagine that it would benefit some other large players to sow uncertainty and doubt about Open Source Software.
> The thread then gets down to business and starts coordinating revert patches for everything committed by University of Minnesota email addresses.

What's preventing those bad actors from not using a UMN email address?
That element has already been evaluated, and is re-evaluated every time this argument is made.

A private platform is free to censor users as they see fit, as the users are free to A) not use their platform at all, B) use a competing platform, or C) create a competing platform. You are not compelled to post your thoughts on FB, or Hackernews, or anywhere else, nor are you entitled to a platform to do so there.

The flip-side, censorship by gov't, is platform independent. This is where the 1st amendment protects come into play, defending you (and the hosting platform) from gov't suppression regarding political or religious speech. If the USA hosted an official message board, then we could argue comparisons to China.
I would not consider anything that is written in the Daily Mail "truth" by any reasonable understanding of the word. They write op-ed pieces at best, and more often than not just make things up or deliberately twist things out of proportion or context.
With relegation and promotion is there no tournament between the promoted and relegated teams? Without this, it seems that the same teams could seesaw back and forth year to year.
So does that mean there is a significant difference between, for example, a malicious USB device versus a damaged USB device, from the kernel point of view? It seems that both would be sending incorrect data that the kernel should catch, right?
Nice way to shame someone brave enough to admit they were lacking in knowledge and announcing action to improve their live.
Have been experimenting with mammoth [1] for postgresql and am quite happy with how close it is to actual SQL.

[1] https://github.com/Ff00ff/mammoth
Great marketing. I wonder the sales difference if they were also selling Macs with current generation AMD Ryzen chips manufactured on a modern TSMC node.
Probably due to the rise in cloud. Where people run software on hardware which is totally abstracted away from the end consumer.
It seems fair enough to me. They were curious to see what happens, this happens. Giving them a free pass because they're a university would be artificially skewing the results of the research.

Low trust and negative trust should be fairly obvious costs to messing with a trust model - you could easily argue this is working as intended.
No need to test really - indeed more complicated cases are not covered by this yet. But happy to look at any Github issues with reproduction of cases that are not working, but could or should work to make your life better.
Wouldn't that draw more attention to the research patches, compared to a "normal" lkml patch? If you (as a maintainer) expected the patch to be malicious, wouldn't you be extra careful in reviewing it?
Thank you. We have just launched our website. We will try to make the search better ...
I am in the same situation. The features were implemented and all the executives were happy. Now the product reached the customers and all I do is support and bug fixing instead of implementing nice-to-have things. Executives love to ignore all costs during the whole product lifecycle. I am not surprised here at all.
That's not the issue. If you buy a Tile with a non-replaceable battery, the actual battery life will vary greatly depending on various factors: how long it was sitting on the shelf before you bought it, the temperature of the environment it's located, how often you make it ring, etc.

11 months after activation, the Tile app constantly blasts you with warnings that you need to "Re-tile" and buy a replacement: via email, app notifications, repeated non-dismissable (only "snoozable") in-app alerts, and a lot of doom and gloom UI that presents a false sense of urgency.

The truth is, the battery can last 2 or even 3 years sometimes, and you don't need to be notified by the app when it's dead - you'll know it's dead when it shows up as "not reporting status" despite you knowing where the tile is. So you should be able to tell the Tile app "Yeah, I know it is near end of life, stop bothering me about it" one time, rather than the app acting insane and showing constant notifications/red warning labels/etc.
Ah, I must've missed that. I do see people saying patches have reached stable trees, but the researchers' own email is missing (I assume removed) from the archive. Where did you find it?
If those offshore dollars come home, or maybe even if new dollars stop leaving, there is nothing that can prevent financial collapse. The government will try absolutely everything to get that money from citizens, and it will only push more money out. The other option is extreme domestic austerity, tax friendliness, and digital modernization.

Suppose you were involved in a financial war. Could there have been a better setup for the adversary’s victory than the domestic spending plans of 2020/21? The people who vote for these measures can’t possibly be ignorant of the situation.

Regarding financial crime enforcement, I believe that it can be done in a way that strengthens the currency. Generally that means eliminating activity which is net negative for the economy (the other holders of dollar-denominated assets), including the cost of compliance and lost opportunity for commerce. Right now, a common view is that it is overreaching, although this view may be ignorant of all the terrible things it is preventing. Regardless, we are now in competition on this aspect of our monetary system as well.
If you blindly trust hardware then on potential attack vector is malicious hardware. This used to be known as the Evil Maid attack. If a bad actor get's access to your hardware the thinking goes then all bets are off. And what happens when a significant portion of your hardware is built in a country known to be a bad actor? Well maybe the kernel should start treating the hardware as potential attack vectors now.
More like 8k+ when i worked there in 2017. Wiki page is outdated.
And I found this: https://thelandlordgame.com/index.html

Seems to be based on it. Don't know how closely it relates but it is CC-BY-NC-SA 4.0 licensed and you can just download it.
The goal is not penalizing or lumping everyone together. The goal is to have the issue fixed in the most effective manner. It's not the Linux team's responsibility to allow contributions from some specific university, it's the university's. This measure enforces that responsibility. If they want access, they should rectify.
How dare they highlight the vulnerability that exists in the process! The blasphemy!

How about you think about what they just proved, about the actors that *actually* try to break the security of the kernel.
Tax/tech attorney here (though not your attorney, not legal advice), so take my comment with a grain of salt.

Don't use a service. Get a tax attorney to review your particular situation and advise. It will be worth the higher cost upfront to get it right and not face issues down the road.
Yes, the owners want their status to mean they receive more guaranteed income.

But that’s not how football works. Status and brand shouldn’t matter, you get money based on your results.

Most of these clubs are pretty much assured of qualification for Europe anyway, but at least they earn it by finishing in the top few places in their national league.

They already have the most money, they want to get rid of the risk that they might not always do so.
> So, the real advantage of OSS is on the auditability after the patch is integrated.

If that's the claim, then the research work discussed here is indeed not relevant to it.

But also, if that's the claim, then it's easy to point out that the "advantage" here is hypothetical, and not too important in practice. Most people and companies using OSS rely on release versions to be stable and tested, and don't bother doing their own audit. On the other hand, intentional vulnerability submission is an unique threat vector that OSS has, and which proprietary software doesn't.

It is therefore the window between patch submission and its inclusion in a stable release (which may involve accepting the patch to a development/pre-release tree), that's of critical importance for OSS - if vulnerabilities that are already known to some parties (whether the malicious authors or evil onlookers) are not caught in that window, the threat vector here becomes real, and from a risk analysis perspective, negates some of the other benefits of using OSS components.

Nowhere here I'm implying OSS is worse/better than proprietary. As a community/industry, we want to have an accurate, multi-dimensional understanding of the risks and benefits of various development models (especially when applied to core infrastructure project that the whole modern economy runs on). That kind of research definitely helps here.
What are the phases of digital product development?
https://en.wikipedia.org/wiki/Google_China
A seat belt is a safety feature, while bullet-proof glass is a security feature. The major shift in thinking was that the kernel needed to start adding bullet-proof glass rather than better seat belts.
But the NFL distributes all TV money equally to all teams as well even though no one in Malaysia wants to watch Tampa Bay. Further most of that money goes to the players not the club owners. How do you square that with your thesis?