skysight-inc/HackerNews huggingface dataset:
>By a truly unbelievable coincidence, I was recently out for a walk when I saw a small package fall off a truck ahead of me. As I got closer, the dull enterprise typeface slowly came into focus: Cellebrite.

That's just hilarious! Nice way of saying we got our hands onto one of these boxes, but we don't want to reveal how. It fell of a truck.
Near Real-Time Social Distancing in London
It’s pretty likely they’d still be waiting for permits. The “nimble” option isn’t opening a food truck in SF, it’s opening in a different city/state that’s easier to do business in.
Exactly what I was thinking. This should have been set up like a normal pen test, where only seniors very high up the chain are in on it.
It's more like: "ask people about themselves, they like talking about themselves", than secret jedi mind tricks. Not really nefarious.
More DRM-free sources, if anyone is interested:

https://www.springer.com

https://www.informit.com

https://pragprog.com

https://www.manning.com

https://www.elsevier.com/books-and-journals

https://nostarch.com
Does Youtube track if I skip the ad segment? Or better: do the uploaders know how many users saw the ad?
With very low viscosity, air is very good at sneaking out of a mask making it ineffective.

Luckily you can give a good puff and feel with your fingers any air coming through your eyebrows or around the cheeks.

Also covid tends to spread via ballistic spray more than aereosol so blocking the spraying is still useful.

Spend time adjusting the metal piece over the nose. Stay safe!
Your reports are either engaged because the work is interesting or the product is meaningful

The point is that all members on a team may believe the work is meaningful and interesting, but still be unproductive due to group dynamics that penalize certain types of behavior that would constructive if they were allowed. It doesn't matter how meaningful or interesting things are if a co-worker or manager shuts you down every time you present a differing opinion on something.
Haven't tried this commercial client myself and I'm not endorsing it, but this one claims to be native rsync without cygwin:

https://acrosync.com/windows.html
These documents appears to be just PDF schematics and electrical specifications, not even the real files that can be opened by Cadence Orcad or Allegro, anybody making a minimum wage in Quanta's production line have access to some of those files. If you are patient it is quite trivial to accumulate those documents and the tactic quite lame.

As someone who has audited Quanta in my previous jobs, I am constantly being surprised that these documents are leaked so infrequently. A "Project" in Quanta start with the customer send in their schematics and mechanical drawings to the Quanta "R&D" engineers so they could redraw it to enable production in Quanta, aka EVT; then it is DVT for multi-sourcing of components and compatibility and EMC compliance, then it is PVT. Engineers usually transform the documents to PDF files and upload to the company's document center, production line operators will download those PDF files and copy it here and there, maybe even with a USB thumb drive to copy it to a production station running Windows 98 and Adobe Reader with no network access. The factories get so many projects that the leaked document maybe is for a product that already died in EVT.

It is also amazing to me that those PDF iPhone Schematics always leak to the 3rd party repairman after sometime it is announced, apparently there is an invisible food chain. But for this one, REvil is simply trying to brand themselves instead of the ransom.
It obviously hasn't hurt enough for them to do better at scanning.
+1 Great looking UI, good luck!
I tried google much but there were too many results haha. Do you have a few that you recommend?
I have to use a secure Windows laptop for work, but I admin Linux servers. WSL has been great for me, if only so that I can use a real linux command line and terminal instead of PuTTY when I SSH into boxes.
Yeah, I guess if you don't use typescript? But isn't that a lot of the appeal of deno? The browser can't import a TS module.
> Does the ban stay with UMN, even after everyone involved left?

It stays with the university until the university provides a good reason to believe they should not be particularly untrusted.
Advertising... is shitty.

Not just for Tesla, lots of companies make exaggerated claims about their products. Take a look at any advertising around SuperCruise and you’ll see the phrase “Hands Free Driving” about a million times. But fundamentally it has the same limits on self driving as Tesla. SuperCruise and AutoPilot both rely on the driver to intervene. If Musk gets crap for briefly taking his hands off the wheel on TV, how does GM get a free pass on marketing as “Hands Free”?
There are some debates in the comments involving process-based comparisons, e.g., when carbon release from decay outweighs carbon sinking from plant metabolism.

It may be helpful to give this top-level summary from the National Climate Assessment [1]:

"Net storage of atmospheric carbon by forests (742 teragrams, or Tg, of CO2 per year from 1990 to 2015) has offset approximately 11% of U.S. CO2 emissions. Assuming no policy intervention – and accounting for land-use change, management, disturbance, and forest aging – U.S. forests are projected to continue to store carbon but at declining rates (35% less than 2013 levels by 2037) as a result of both land use and lower CO2 uptake as forests grow older."

[1] https://nca2018.globalchange.gov/chapter/6/ -> "Forest Carbon Dynamics"

The NCA is your best one-stop-shop for the best current synthesis on such questions, unless you're literally publishing in this specific area (in this case, carbon cycle science at decadal timescales).
I'm curious -- what is not possible with just JavaScript? Why do you assume "a full-blown app inside a web browser" isn't possible without React or something like it?

Is client-side rendering strictly necessary? Do your websites actually run offline?

I've built websites with React, used React Native -- none of it is necessary, nor the end-all-be-all. There's nothing truly novel going on. You can accomplish the exact same experience with server-side rendering and a tiny smattering of vanilla JS (you can use modern JS and polyfills and webpack/esbuild without React, you know).

For 99.9% of the web, I'd argue you don't need it. I have yet to encounter the 0.1% personally.

If you don't believe me, know that I'm not alone. Take a look at https://levels.io/deviance/ -- PHP and jQuery. What would React provide that isn't possible with his stack?

There is a disturbing amount of kool-aid being consumed around React/Vue/etc. Sure, you can slap together a website in record time with massive boilerplate/templates -- but so can I.
Early on in my career it was nearly impossible to have psychological safety because I was constantly worried I'd be risking my physical safety if I did anything that could put my job at risk.

I attribute a lot of this to weak social safety nets and at-will employment in the US. I constantly feared that I would be fired for some statement, personality clash, or mistake (or for no reason at all, which is entirely legal)... so I kept my head down and was lightly abused (frequent overtime without pay, tolerating verbal abuse, etc).

I was living paycheck to paycheck and without a job I'd rapidly lose housing and healthcare. It took me nearly a decade to attain financial security while racking up psychological damage.
> My mother's neighbor sold their house within 2 hours of it going on the market

I have to wonder, though - where are the people who are selling their homes moving to? They're stuck in the same insane buying spiral everybody else is.
Why Is Big Tech Under Assault? Power
When you use software volume control, you're not changing the volume of the speakers - you're changing the volume of the recording. If your speakers have any background hiss - and they do - then making the recording quieter makes that hiss easier to hear. What's more, even the recording itself actually inherently has a kind of "hiss" because, in any recording medium, there is a quietest possible sound.

You can hear it for yourself - turn the volume in VLC very low down, and your speakers all the way up to compensate, and listen to a record - it'll sound bad. The louder your speakers, the lower you'll be able to crank VLC, and the worse the whole thing will sound.

Making the recording louder is - theoretically - fine; it shouldn't make it sound any worse. But if the recording is well-mixed, there's no headroom to make it louder and it will distort - this is because the engineers make the recording as loud as possible to avoid exactly the above issue.
I'm a little confused what's unclear if you happened to see that comment - as mentioned elsewhere in this thread, the bad actors state in a clarification paper that no faulty commits reached a stable branch, in the original paper state that the no patches were being applied at all and that essentially state the research was all email communication AND worded it such that they 'discovered' bad commits rather than introduced them (seemingly just obtuse enough for a review board exemption on human subject research), despite submitting patches, acknowledging they submitted commits, and Leon and Greg finding several vulnerable commits that reached stable branches and releases. For example: https://github.com/torvalds/linux/commit/8e949363f017

While I'm sure a room of people might find it useful to psychoanalyze their 'unclear' but probably malicious intent, their actions are clearly harmful to researchers, Linux contributors, direct Linux users, and indirect Linux users (such as the billions of people who trust Linux systems to store or process their PII data).
I'm genuinely curious how this was positioned to the IRB and if they were clear that what they were actually trying to accomplish was social engineering/manipulation.

Being a public university, I hope at some point they address this publicly as well as list the steps they are (hopefully) taking to ensure something like this doesn't happen again. I'm also not sure how they can continue to employ the prof in question and expect the open source community to ever trust them to act in good faith going forward.
Surely all of the money invested into that SPA could be redirected into a simpler full-stack app, with sprinkles of progressive JS?

On the one hand you have a shared-nothing architecture that serves HTML and can enjoy varying forms of caching.

On the other you have an application that still depends on a server, but replaces all of that simplicity with a stateful client-server architecture that requires _more_ infra to manage, at a greater expense.
No. Don't do any of these things. The reason U+FFFD exists, even though ASCII has any number of fun things you can scribble in one byte is that U+FFFD specifically isn't any of the things your program probably didn't expect to appear unexpectedly after unrelated processing.

It isn't a letter, or a digit, or whitespace, or punctuation, or a word separator, or a control character, it is neither uppercase nor lowercase, it doesn't have any canonical equivalents - it's just a codepoint that exists specifically for this purpose.

As a result it's much less likely that if gibberish sneaks into your system somehow and gets turned into U+FFFD this causes something important to break elsewhere.

And when sooner or later a human is shown this text, it's very obvious that U+FFFD isn't what they expected, whether that was E-acute, a Euro currency symbol, a cat emoji or whatever else, and the human will know something went wrong and can decide if they care about that.
I can't imagine burning pine in a stove, except as kindling.

The notable invasive species where I live is ailanthus. I've burned some out of curiosity. It's better than pine, but not worth the trouble when you're tripping over red oak.
I'm vaccinated, why the hell should I wear a mask besides the fact that the government says so? The odds of me having any detectable viral load to transmit are extremely low. [1]

[1]https://www.cdc.gov/media/releases/2021/p0329-COVID-19-Vacci...
Maybe they have their reason to put the screenshot on the bottom... :)
You absolutely can claim that, and it gives a nice clean division into two classes, that's sometimes useful and usually lines up with other assessments of sex and gender.

But it's not the only way to do it, and if you do that you won't necessarily agree with other people about a person's "biological sex".

For instance, there is a condition called "complete androgen insensitivity syndrome". A person with CAIS has one X and one Y chromosome, just like a typical man, and they produce male sex hormones much like a typical man does. (Maybe exactly the same? I'm not sure whether there are feedback loops that might go wrong.) But the cells in their body that are meant to respond to those hormones don't, and as a result a person with CAIS looks pretty much exactly like a typical woman does. Breasts, mostly-normal-female genitalia, not much body hair, higher-pitched voice, etc. But^2 they don't have a uterus, they aren't fertile (either "as" male or female), and there are internal genital differences that may have adverse consequences for their sex life if nothing is done about them.

If you just go by chromosomes, you will classify people with CAIS as male. But these people are all assigned female at birth, and they usually have no idea until puberty that there is anything at all unusual about their sex or gender. Their gender identity is almost always F rather than M, and they are generally heterosexual in the sense of being attracted to men.

So, what is the "biological sex" of someone with CAIS? I think several answers are defensible, but none is clearly correct or universally agreed. So "biological sex" is not a term with a clear-cut meaning in every case, contrary to "Proposition B".
I've tried it. And yes, I want full control. The abstractions mostly work, but when they don't -- there you are again, thinking about transitions in native JS again. What was the point?
It would be possible to do this by querying the specs repo https://github.com/CocoaPods/cdn.cocoapods.org. This is what the web-app does.

I noticed that quite a few pods have more than 1 distinct source when checking the pods used by projects I have worked on. From what I could see source changes were the result of ownership changes, GitHub account name changes, etc.

So i'm not sure how to distinguish malicious source changes from innocuous ones. Maybe it would be worthwhile to search for source changes that lasted a single release and reverted thereafter.
25 Horses
You cannot prove a hypothesis with 100% certainty, that is true. But you can falsify it – with even a single counterexample – and then you are certain it is false. Anything else is pseudoscience.

And it's particularly not okay to make generalizations about people. That's how you get sexism, sexism and other bigotry.
What would these cpu instructions do?
You seem to contradict yourself by diminishing the impact of psychological safety at the same time that you give an excellent example of how it might have helped a project.
Genuine question, if old-growth forest do not work as carbon sinks, how all the petroleum we are extracting comes from? Is all from ancient marine environments?
I agree. My workplace has at least a dozen applications deployed to production with "just JS" and they're just at production ready as a react stack would be.

Source: Running "just JS" in production for more than 6 years.
One should never loose to the complier, after all you can see it's output and it can't see yours.

Also, the programmer can "cheat" by doing things the compiler would consider invalid but are known to be ok given the larger context of the application.

The restrict keyword in c gives an example of how one can optimize code by knowing the larger context.
https://cellperformance.beyond3d.com/articles/2006/05/demyst...

The problem is the ROI is usually pretty bad as these assumptions rarely hold as the code evolves, in my experience, and the optimization usually only lasts for finite (sometimes shockingly short) amount of time. i.e. OS changes, hardware changes, memory changes, etc. etc. etc.
It's by their own admission, this is "very experimental" in Electron 12 and hence not enabled by default.

https://github.com/electron/electron/pull/26022#issuecomment...
> Psychological safety describes a belief that neither the formal nor informal consequences of interpersonal risks, like asking for help or admitting a failure, will be punitive. In psychologically safe environments, people believe that if they make a mistake or ask for help, others will not react badly. Instead, candor is both allowed and expected.

People feel "psychologically safe" because they have confidence. They have confidence because they have a track record of getting things right. They might be wrong now but they have enough credit to risk being wrong. Successful teams have people who speak up because those people are confident (likely due to a history of success).

In any case, in the event that you speak up and are wrong, there's no way you can be insulated from "formal nor informal consequences of interpersonal risks". If someone says something that I know to be wrong, it makes me think less of them. Will I be rude to them? No, but if it keeps happening I'll pay less attention. Kind people will give you plenty of chances but only stupid people will give you infinite chances.

The perspective here, where we should aim for "psychological safety" is minimizing one kind of fail case (people not speaking up because they're afraid) and maximizing another (people speaking up and being wrong). It isn't obvious that you should make that trade-off.
Well done, great demo!
first statement + commentary from their associate department head: https://twitter.com/lorenterveen/status/1384954220705722369
Backdoor Found in Codecov Bash Uploader
Independent Components: The Web’s New Building Blocks
They are implying that future versions of Signal will drop random files on your phone that "may or may not" cause damage to Cellebrite systems.

They are basically putting the threat out that if you use Cellebrite on Signal in the future, you might not get the data you expect, and at worst, it may corrupt the report/evidence.

This also brings into question the chain of custody, as an untrusted device being imaged can alter reports of unrelated devices.
> In computer forensics it's ALL about being able to verify, without a shadow of doubt that something is what they say it is

Mostly. The other side gets all the evidence that the opposing side sees. They both get a chance to review it.

> Chain of custody rules everything.

Agree.

> This blasts a huge gaping hole in all that.

Not really. The analysis goes in two steps. One is to pull all the data from the phone, in a chain-of-custody manner. In an adversarial case, both sides can do this.

The collection and analysis go into two steps. First is moving the data to windows box. Next is the analysis. As I understand it, the analysis portion is where things can explode. Then, if in the hands of someone skilled in forensics, the extracted data would be saved in some other device, possibly to be shared with the other side. Then the risky, potentially explosive analysis would be done. It is very unlikely that all previous cases exist on that device and nowhere else.

Therefore,

> It calls all past and future cellbrite reports into question.

is not true, as the extracted files are likely not on the collecting windows device.

In any case, it is not clear how many uses of this device are in actual legal environments.
Yep, exactly, it's very much a situational decision. And to be fair, cost wasn't my primary concern in deciding to use wood heat, but as above I don't think it was a silly decision.

I've got one of these https://pyroclassic.co.nz/ - it's not a new design but is quite clean (it's usually impossible to tell if a fire is going by looking at the chimney) and efficient as far as these things go.

The lifetime cost of the equipment itself must be lower for an efficient wood stove+flue than an efficient heat pump, in both dollars and environmental impact. The initial install cost here in NZ is a little bit higher for the fire, but annual maintenance (flue sweeping) is something an average homeowner can do in an hour or so, where heat pumps need regular cleaning from the homeowner, and are supposed to be checked on by a technician periodically. The fire can reasonably be expected to last half a century with a few minor repairs. When it eventually does need a full replacement, that's just some steel and ceramic - no electronics, refrigerants, or plastic involved.

Electricity here is expensive - last bill was NZ$0.42/kWh - and wood isn't so much. My last batch of primo firewood was IIRC NZ$100 per tossed m^3, and yes that takes some time to stack and such (firwood warms you twice!), however there's also a fair bit of free wood to be had.

To use round numbers, say the heat pump is 250% efficient making heat, and the fireplace is 50% (after writing most of this, I see that fireplace is claimed to be 74% efficient). That tossed m^3 of firewood is about 0.2 (stacked) cords and contains about 1170kWh energy from some quick searching, so $100 in firewood gives 586kWh heat in to the house. The same heat from a heat pump would've cost $98.45 - the difference is a decent pint or two per year in heating the house...

But, the biggest argument is that you don't actually use a heat pump in the same way as a fire. It takes a while for the fire to start cranking out heat, so I only build a fire if it's worth having one going in an hour or so. If I had a heat pump, I'm sure we'd have it turned on in the morning as well as evening, so it would be used to put out substantially more heat than the fire does.

Heat pump cooking isn't really a thing either...
Nice that this is easier, but is this better than just using VcXsrv?
The article doesn't say old growth forests don't work as carbon sinks, just that don't work as well as they initially thought.
After some light research, you can apparently subscribe for as little as $5k per-month [0]. Not sure how you'd link a GAID/IDFA to a person's identity though.

[0] https://datarade.ai/data-products/lifesight-mobility-data
That's exactly it, maximizing profit. Lots of rental units, at least in my area, aren't owned by individuals anymore. They're owned by corporations or private equity who have an obligation to their shareholders to maximize profit. If I stop renting, someone else will pick up the bill.

The landlords' operating costs haven't gone up significantly either. They own the property outright, the same maintenance crew is around, they're down a leasing agent and manager from a year ago, and property tax increases are capped in this city. Any rent increase they can push beyond inflation directly lines their pockets.
> Free fully supported Linux distro with Windows support will only reduce the sales of Windows itself.

I didn't say free, though that is one option.

I'm thinking if they could build a DisplayPS compositing window manager on top of, say, an MS-supported Ubuntu derivative, make the window manager awesome, market and sell it as Windows NC for Next Century, build in hardware support for everything -- basically go all-in.

Keep the next-gen window manager, core apps, and the Win32/DirectX compatibility layers proprietary, the rest open-source, and license the whole thing. Charge $200 per license or something.

If they did all that, they'd make a killing.

The fact that it's a Linux distro at its core would be a relatively small detail (and a killer feature for developers at the same time). Darwin is also open-source, but MacOS on top is highly proprietary and profit-producing.
I've done it often enough and had things work out well, but you do have to know your audience and pick your battles. If no amount of reasonable conversation is going to change something, even if it is very obviously wrong, you have to let it go.