skysight-inc/HackerNews huggingface dataset:
Or you could cease to do the voluntary work for them, because they clearly are not contributing to your goals. This is what the kernel maintainers have chosen and they have just as much right to do so. And you can perfectly well do this with consent, there's a wealth of knowledge from psychology and sociology on how you can run tests on people with consent and without invalidating the test.
> (whereas we know that the strength of open source is its auditability, thus such bugs are quickly discovered and fixed afterwards)

Which is why there have never been multi-year critical security vulnerabilities in FOSS software.... right?

Sarcasm aside, because of how FOSS software is packaged on Linux we've seen critical security bugs introduced by package maintainers into software that didn't have them!
in the world of front end dev always expect the unexpected. the amount of head-scratching moments i've had....lost count.

i think the worst and most frustrating type of "bug" (not really) - is the "reload - no update" issue. not sure if it has another name.

its when you make some change, reload the browser but the update is not reflected :D - usually very trivial but often times the straw that broke this camels back.
Journal retracts paper suggesting smoking is linked to lower Covid-19 risk
Flash loans are not a real world application. They are just another tool needed within the cryptospace itself.

This is the problem currently. There's ten thousand teams building and building, but each one of them is building yet another library or yet another tool. Nobody has any idea how to connect the crypto economy to the real world economy.

The only applications possible are ones that you can do within the cryptospace itself, like lending one crypto against another, or creating some creative gambling game.

Unless somebody can figure out how to bridge the cryptospace to the real world economy, the whole castle of cards will eventually crumble.
Kind of sounds like the New York Times.
The earlier patches could in theory be OK, but they also might combine with other or later patches which introduce bugs more stealthily. Bugs can be very subtle.

Obviously, trust should not be the only thing that maintainers rely on, but it is a social endeavour and trust always matters in such endeavors. Doing business with people you can't trust makes no sense. Without trust I agree fully that it is not worth the maintainer's time to accept anything from such people, or from that university.

And the fact that one can do damage with malicious code is nothing new at all. It is well known and nothing new that bad code can ultimately kill people. It is also more than obvious that I can ring the door of my neighbor, ask him or her for a cup of sugar, and blow a hammer over their head. Or people can go to a school and shoot children. Does anyone in his right mind has to do such damage in order to prove something? No. Does it prove anything? No. Does the fact that some people do things like that "prove" that society is wrong and trust and collaboration is wrong? What an idiocy, of course not!
MikroORM. I think it's the best ORM for TypeScript.
Elon Musk Smoking Cannabis on Joe Rogan Is Now 69 NFTs
Virtual Clinic UX Design Recommendations
I was expecting this to be about introducing strange bugs and then claiming to fix them in order to get a publication. But the publication is titled "On the Feasibility of Stealthily Introducing Vulnerabilities in Open-Source Software via Hypocrite Commits"! So I guess it's less feasible than they imagined, at least in this instance.
In penetration testing you are doing the same thing, but you get the go-ahead for someone responsible for the project or organization since they are interested in the results as well.

A red team without approval is just a group of criminals. They must have been able to find active projects with a centralized leadership they could ask for permission.
One flavour I would expect to be valuable that isn't present here is this:

Process the input (as quickly as possible) and never fail, but replace each invalid sequence of bytes with U+FFFD (bytes 0xEF 0xBF 0xBD).
I hope USENIX et al ban this student / professor / school / university associated with this work from submitting anything to any of their conferences for 10 years.

This was his clarification
https://www-users.cs.umn.edu/~kjlu/papers/clarifications-hc....

...in which they have the nerve to say that this is not considered "human research". It most definitely is, given that their attack vector is the same one many people would be keen on using for submitting legitimate requests for getting involved.

If anything, this "research" highlights the notion that coding is but a small proportion of programming and delivery of a product, feature, or bugfix from start-to-finish is a much bigger job than many people like to admit to themselves or others.
using tmpfs... it'll help a bit (I used mysql-on-tmpfs before)
these people have no ethics
Prefabricated cabin for remote working is a must have home office
It could have been done similar to how typosquatting research was done for ruby and python packages. The owners of the package repositories were contacted, and the researchers waited for approval before starting. I wasn't a fan of that experiment either for other reasons, but hiding it from everyone isn't the only option. Also, "you wouldn't have allowed me to experiment on you if I'd asked first" is a pretty disgusting attitude to have.
Terrible click-bait title. They are asking the competition watchdog (ARM is a UK company) to asses the takeover. This is no different from the FTC in the US reviewing a takeover to make sure it's not anticompetitive.
Complicated stuff will always be complicated.

The .NET ecosystem is huge, there are a lot of different frameworks associated to any kind of problem. Xamarin for mobile; EF 6, EF Core, ADO.NET for databases, and so on.

But as a beginner you shouldn't try to understand it all, right from the beginning. Just start somewehre.

It's like saying: "Biking is too complicated, there are so many different kind of bikes, who should know what to buy!" Just get the first best bike / framework (e.g. console app, or asp.net core) somebody recommends you and go with that until you know better. After a while you will understand the difference between a mountain bike and a downhill bike, or between EF 6 and EF Core.
Does the University of Minnesota have an ethical review board or research ethics board? They need to be contacted ASAP.
Confluent Cloud CLI Tool (ccloud) Vulnerability: Credential Exposure 3rd Party
From the Confluent Support Portal (requires an account):
Published 2021-04-20 21:39

> Confluent Cloud CLI tool (ccloud) Vulnerability: Credential Exposure to Third-Party Analytics
Yesterday at 21:39
Impacted versions: 1.21 (released November 20, 2020), 1.22, and 1.23

>Recommended action: Update the Confluent Cloud CLI tool to version 1.25.

>The Confluent Cloud CLI tool, known as ccloud, contained a vulnerability that resulted in the transmission of Confluent API keys and secrets to a third party data analytics service when users entered an API secret as an argument to the tool.

>The third party service is a vendor used by Confluent to collect metrics and usage data for analysis. Previous versions of the CLI tool employed filtering to prevent the transmission of API keys and secrets.

>As part of our incident response, we immediately instructed the third party service to stop collection of ccloud analytics data and to delete all such data from its systems. We also released a new version of ccloud, version 1.25, which does not have this vulnerability.

>We have analyzed the data sent to the third party service and identified customer accounts from whom API keys and secrets have been sent. We have notified those customers. Our initial investigation has revealed no evidence of misuse of the API keys or secrets or any compromise of customer data.

>We urge all customers to update the Confluent Cloud CLI tool to version 1.25. If you already have ccloud installed, the simplest way is to log in to the Confluent Cloud CLI and run the following command:

> ccloud update

The embedding of 3rd party analytics tools to track usage metrics will be the undoing of us all. If you are going to track users then at the very least own the entire tracking apparatus so that it does not get leaked to a 3rd party if you make a mistake.
One hilarious front end bug is posting a blog to a platform that discourages reading the blog.
A far better approach would be to study patch submissions and see how many bugs were introduced by the result of those patches being accepted and applied, without any interference of any kind.

Problem with that is it's a lot of work and they didn't want to do it in the first place.
By “private” I meant transaction privacy, which is offered by Monero.
One second delay, but yea here: https://news.ycombinator.com/item?id=25448718
The bugs were found. Seems like it works to me.
Number of deaths is not the only metric of concern. The batteries can cause life changing injuries within hours. The immediate symptoms can be easily mistaken for a flu. Doctors do not require an X-ray for the flu. Without an X-ray the button goes undetected.

Excluding the issue of misdiagnosis, if every case was found by medical practitioner at first sight, there are still major complications and possible surgical intervention required to remove the battery.

These numbers are from a country with a population of 25 million. Im sure the numbers of injuries and deaths are much higher in countries like the US.
I have a feeling that does not work at all in non-trivial scenarios, e.g. if both composite keys and date range matching are required to resolve a reference.
There are many data engineers at companies who have to write custom little scripts to take data from spreadsheets into an analytics DB.

Thanks for removing some boilerplate from that process for people!
Prisma 2 is a delight to use. Gave it a try after typeorm-model-generator’s author suggested using something else than TypeORM. Prisma blows other JS/TS ORM libraries out of the water. It integrates so well with VS Code
To provide some parallel on how the research was carried about:

I see it as similar to

- allowing recording of people without their consent (or warrant),

- experimenting on PTSD by inducing PTSD without people consent,

- or medical experimentation without the subject consent.

And the arguments about not having anyone know:

Try to introduce yourself in the White House and when you get caught tell them "I was just testing your security procedures".
This patch wasn't. Other patches from the university had made it into stable and are likely to be reversed, not because of known problems with the patches, but because of the ban.
You need to compare what happens with vulnerabilities in OSS vs in proprietary.

A maintainer pakage is just one more open source software (thus also in need of reviews and audits)... which is why some people prefer upstream-source-based distribs, such as Gentoo, Arch when you use git-based AUR packages, or LFS for the hardcore fans.
Show HN: Exactly-once delivery counter using Watermill messaging library
Leaked Ukraine memo reveals scope of Russia's aggression
I'm on the same boat as you.

I'm envious of game devs, I do not know what went wrong in web land that we can not have great smooth user interfaces and smooth animations. I'm sorry but the DOM is not it and is holding us so far back its unreal.

I really hope for a shakeup of some kind. Have a skim through this video [0]. An indie game using the Unity interface builder I believe.

[0] https://youtu.be/bk6wkXI-42Q?t=617
Likely because IBM mainframes are outside of the reach of hobbyists and SMEs.
> Understandable from gkh, but I feel sorry for any unrelated research happening at University of Minnesota.

That's the university's problem to fix.
Yeah, but the intel has more PCI lanes available, the M1 is more restricted.
> But an actual war would obliterate both sides.

No, it wouldn't. Europe 560M people, and the world's biggest economy as a EU bloc.

Russia 139M people with only 20M of military age, of which 1/3 fares from Caucasus, and other less than loyal ethnic republics.

A Russian first strike on NATO block will take down 40M-50M at maximum even if Russia will only target large population centres.

The retaliation busts Moscow — it's only economic, and industrial centre, and that will be it for Russia.

It will however not guaranteed to win the following conventional war, given Russian advantage in armour if it can strike first.

If Russian airforce, and AA will be gone before their armour, the overwhelming manpower advantage of Europe will then win the conventional war despite Russian armour advantage.
I agree, and find the reluctance to care about SQL interesting.

Sure, SQL is not perfect, and has it’s flaws. But instead of learning an established, declarative language designed for data access, there are developers that would much rather learn new tools and libraries to avoid it. If you need to use another programming language for data access, you’re off looking for another ORM. Or the next, better ORM of the year comes out.

There are stored procedures at my work that are more than 20 years old. They don’t need to change when the application code calling it is uplifted.

It’s not that much different than a modern React dev not wanting to understand how a plain HTML form works.
> it’s commonly argued that open source is better for security because there are more eyes on it.

> What this research demonstrates is that you can quite easily slip back doors into an open contribution

To make a fair comparison you should contrast it with companies or employees placing a backdoors into their own closed source software.

It's extremely easy to do and equally difficult to spot for end users.
There is a concept, on forums, of shitposting.

There are common expressions such as "chatting shit" for unverified speculation or "shooting the shit" to mean talking about nothing and everything.

I suspect most of the content on Mastodon, like twitter, is shit. The choice of words seems appropriate.
"We're going to, as part of a study, submit various patches to the kernel and observe the mailing list and the behavior of people in response to these patches, in case a patch is to be reverted as part of the study, we immediately inform the maintainer."
How is this supposed to work? Do you trust everyone equally? If I mailed you something (you being the "subject" in this case), would you trust it just as much as if someone in your family gave it to you?
What is the common meaning here?
feeling like you're "behind" and acknowledging the amount you don't know about a field are two different things

one is a social comparison, the other is an epistemological observation
I write backend code, and it's basically Java + Spring. No web technologies beyond HTTP in sight.
This is absurd. You could just as easily refinance or take out a heloc to take advantage of the rise in price that would greatly offset the rise in tax/insurance
Well, yeah, but the priority here shouldn't be to allow the researchers to do their work. If they can't do their research ethically then they just can't do it; too bad for them.
In every commercial pentest I have been in, you have 1-2 usually senior employees on the blue team in the know. They have the job to stop employees from going to far on defense, as well as stop the pentesters from going too far. The rest of the team stays in the dark to test their response and observation.

In this case, in my opinion, a small set of maintainers and linus as "management" would have to be in the know to e.g. stop a merge of such a patch once it was accepted by someone in the dark.
Does Rust allow for libraries to “override” core functionality when available?
Native UI development is a mess. On any platform. It's super complicated.

You will always be unhappy with any choice of UI framework, on any platform :)
I'm certainly biased, being a game developer, but I feel this is a bit strong. Games are very complex and they're entertainment products, not safety critical applications.

There have been a number of high-profile releases which have been rushed out the door and haven't been in a good state until quite a while later. And that's largely an issue of rigid deadlines and crunch. But for most games I feel it's not nearly as bad as people make it out to be. I wouldn't say it's accepted either, since it seems each game plagued by frequent crashes causes an uproar. I will concede that Early Access is often a mess. It used to mean you were literally playing the game before it was deemed ready for release and targeted at only a smaller set of die-hard fans. Now, both customers and developers seem to have lost sight of that.

I've very rarely experienced crashes in modern games in my free time and when I've been tasked with analyzing reported client crashes at work they've been almost entirely due to running the game below minimum specs or crashes caused by MSI Afterburner. Clipping and physics glitches are also mainly caused by low-end hardware or other applications eating resources.

If I look at which games I've been playing actively so far this year that'd be:
Stardew Valley, Breath of the Wild, Super Meat Boy, HITMAN 2, The Last of Us Part 2, Ghost of Tsushima, Xenoblade Chronicles 2, Magic Carpet 2. Of these, the only crashes I've experiences were in the last of these, which is a DOS game from the nineties notorious for being buggy.
> Then you'd have an entire population of overqualified people who cannot find jobs

Why would you? In the time it takes to train, those jobs could be created; if some of those workers become business owners, for example.
>So many comments here refrain, “They should have asked for consent first”.

The Linux kernel is a very large space with many maintainers. It would be possible to reach out to the leadership of the project to ask for approval without notifying maintainers and have the leadership announce "Hey, we're going to start allowing experiments on the contribution process, please let us know if you'd like to opt out", or at least work towards creating such a process to allow experiments on maintainers/commit approval process while also under the overall expectation that experiments may happen but that *they will be reverted before they reach stable trees*.

The way they did their work could impact more than just the maintainers and affect the reputation of the Linux project, and to me it's very hard to see how it couldn't have been done in a way that meets standards for ethical research.
That's exactly what a hostage rescue should be like until there's no other option: negotiations, the peaceful plan.

So you know where the kidnappers live? You grab your shotgun to get them "Rambo style". Best case only the kidnappers get injured or killed. Worst case you and your family get killed.

It feels like too many people simply cannot go past the basic reaction "I find it may be a threat > shoot to kill". I find this a failure in education.

And while it may turn out at some point that for Belarus there was simply no other option, it still doesn't justify jumping straight to it. Just a bit of common sense can already tell you that the most likely outcome is that civilians will get killed by the thousands and this time it will be "justified" as defending against acts of war. Guns escalate everything. They may escalate your power but they also escalate the response.
> wouldn’t every single A/B test done by a product team be considered unethical?

Potentially yes, actually.

I still think it should be possible to run some A/B tests, but a lot depends on the underlying motivation. The distance between such tests and malicious psychological manipulation can be very, very small.
I don’t know much about penetration testing so excuse me for the dumb question: are you required to disclose the exact methods that you’re going to use?
> If you build your business on clickbait and bullshit "journalism" you can't complain when your main source of traffic decides to squeeze a bit more cash out of your enormous money pit.

Is that a legal argument?
Why should an academic institution be afforded any extra trust in the first place?
They put me into prison. Help me to draw a valid argument to escape
I can confirm that. If you don't know exactly what you are doing, don't build a desktop application. Build a web application, you are safe and protected there.
I know prism adds soo much more than just data access for your project, but for just replacing ORMs I think I really prefer the approach of https://github.com/adelsz/pgtyped where you have raw sql files / template literals and it will create types for parameters and results.
Yeah we get to hold people who are claiming to act in good faith to a higher standard than active malicious attackers. Their actions do not comport with ethical research practices.
YES! I'm also really struggling with giving up YouTube due to all the wonderful content available there. I wish there was a widely-used alternative like Floatplane to double-post your videos for your supporters.
Earning 10% "riskfree" isn't speculation, it's a Ponzi. What serious borrower needs to pay 10% to access credit? So then, who are the borrowers who are paying this interest? As they say on Reddit: !remindme 1 year.
Your message would push maintainers to put even more focus on the patches, thus invalidating the experiment.
Hey totally off-topic maybe as it's not prisma-related/required.

What do you think of using something like msw.io for mocking your endpoints as needed?
> Not a big loss: these professors likely hate open source.

> They are conducting research to demonstrate that it is easy to introduce bugs in open source...

That's a very dangerous thought pattern. "They try to find flaws in a thing I find precious, therefore they must hate that thing." No, they may just as well be trying to identify flaws to make them visible and therefore easier to fix. Sunlight being the best disinfectant, and all that.

(Conversely, people trying to destroy open source would not publicly identify themselves as researchers and reveal what they're doing.)

> whereas we know that the strength of open source is its auditability, thus such bugs are quickly discovered and fixed afterwards

How do we know that? We know things by regularly testing them. That's literally what this research is - checking how likely it is that intentional vulnerabilities are caught during review process.
> They wanted to see how the review goes if they aren't aware that someone is testing them. You cant do this with consent.

Ridiculous. Does the same apply to pentesting a bank or a government agency. If you wanted to pentest these of course you'd get approval from an executive that has power to sanction this. Why would Linux development be an exception? Just ask GKH or someone to allow you to do this.
The EU (more precisely France-UK-Germany, parties to the Iran nuclear deal) tried to set up a payment system to keep the deal alive, but European banks and companies like Airbus declined to participate because of the threat of US sanctions. Chinese banks are much less likely to view such sanctions as an existential risk, and many are already under sanctions anyway.

The centrality of the US also stems from its connectivity. There used to be a time when intra-European Internet traffic would be routed through the US, even though the EU economy was larger than the US’ pre Brexit.
While depending on a live DB for testing isn't great, why not just blow away database state after every test by running TRUNCATE / DELETE against all tables? DELETE especially is very fast (couple ms) if you're not inserting large amounts of data during your test runs.
IEEE is a garbage organization. Or atleast their India chapter is. 3 out of 5 professors in our university would recommend to avoid any paper published by Indians from IEEE. Here in India, publishing trash papers with the help of one's 'influence' is a common occurrence