skysight-inc/HackerNews huggingface dataset:
As of now, it's just words on a page. Let's see how their actions back up those words.
They didn’t have to write it.

The first two sentences seem sincere. This reads as a real apology.
> We just want you to know that we would never intentionally hurt the Linux kernel community and never introduce security vulnerabilities. Our work was conducted with the best of intentions and is all about finding and fixing security vulnerabilities.

Either this is a bald-faced lie or they didn't think through the implications of their research, neither of which bode well for their trustworthiness in future. However, if it's the latter, then they possibly deserve additional leeway.

On the other hand, I wonder whether this letter would have eventuated without the ban - if not, then they've likely been forced to write it, in which case any remorse is either selfish (i.e. they've been professionally reprimanded and feel bad about getting caught, or making such an egregious error in judgement), or hollow.

> I agree, but let's give them a little extra benefit of the doubt. I thought as I was reading it that it seemed stilted and forced, then I wondered if the author(s) don't speak / write English as a primary language.

https://www-users.cs.umn.edu/~kjlu/

It looks like you might be right about this, but I think that reading it as stilted and forced is still accurate.
He took the vaccine two weeks ago. Check on his twitter. I suspect blood clots
Boop – Paste and transform text locally
As I understand it, the keyboard is a bottom half and a top case, which means that the seam (https://i.imgur.com/3uedtMo.jpg) is entirely in the control of the keyboard. If that is the case, why the the corner radii differ? It seems somewhat sloppy to have the edges meet at different places like that.
This is way more bleak than the reality, IMO. The biggest tech companies are thriving on the back of free software, and producing a bunch of free software themselves in the meantime.

Watch this talk by the creator of lichess: https://www.infoq.com/fr/presentations/lichessorg-open-sourc.... Do you use Wikipedia?

I personally expect free and open software and services to win in the long run. I think we’ll also see more small companies like Craigslist that completely dominate their segment in a way that’s net positive to society without significantly warping our governments. And in some cases, corporations legitimately are the best stewards. I think that’s fine.

My point is that I extrapolate current trends very differently than you seem to be. You can start a complicated service easier than ever. We’ve reached a point where it only takes one motivated individual to seed a community, build something truly user-oriented, and completely supplant the corporate/profit-driven alternatives.
Only "sorry" because you got yourselves banned.
In Defense of the Space Force
I feel like there's a joke about Perl hiding somewhere in there.
The post you are responding to definitely wasn't very nuanced.

Considering there are so many people whose solar is grid connected you would think that they would often ask themselves how difficult it is to maintain repair and operate the grid they rely on every time it snows or rains or at night.
Except more harsh policing is not the answer to this, especially the opioid crisis. If you want to see less crime and drugs, you improve the conditions that lead people to crime and drugs and then increased social work when people do run afoul.

The current police system in the US does not do that, and the prison system is purely set up to incarcerate folks and then ensure they will fail when they get out so that they end up going back in because gotta grease the wheels of prison capitalism.
There's a distinction between "protection" security software such as antiviruses and VPNs which indeed is an industry filled with scams and conmen, and utility security software such as password managers.

Most of the big name password managers are very good. The only one I'd recommend avoiding is lastpass, and even so they're not that bad, just strictly worse than the others.

Emphasis on big name. 1Password, Bitwarden, keepassx(c), and whatever microsoft's was called.
I mean, I think it's kind of a natural reaction to "well if humanity disappears altogether, what was the point?", so we feel an urge to perpetuate humanity, in order to imbue our own existence with some sort of meaning.
> we did that because we knew we could not ask the maintainers of Linux for permission, or they would be on the lookout for the hypocrite patches.

This bit just reads like "sorry you're upset".

I would have expected something along the lines of "sorry, we should have asked the maintainers and we understand why it was wrong not to", instead of "sorry, we didn't ask the maintainers, but this is why we didn't".
I don’t need convincing arguments. A software password manager is a single point of failure, as the story demonstrates. It’s a dangerous external dependency with alluring convenience.

Until mind reading becomes reality, nothing will ever be as secure as human memory.
> and there’s no point

How do you know "there is no point"? Also, at what points in history was exploration pointless, exactly?
maybe i am being very naive here but that letter read like a sincere apology to me as well.
I think they could have really helped themselves by being humble and truly apologetic. Simple things like:

- "We are sorry for the harm we caused" instead of "We're sorry for any harm we caused"

- Not trying to explain their actions in the first paragraph of the apology! I think most folks are aware of their intent by now, and leading with yet another explanation just makes the whole thing feel disingenuous

- Avoid saying things like "this has been painful for us as well"

Unfortunately, it has so many hallmarks of a non-apology, and it's hard to look past those given the context.

As others have mentioned, they can clear this up with their actions going forward, but it will take time to rebuild trust.
Why is the 5 year payback critical, as opposed to 7 or 8? You're still coming out ahead.
Agree that it could be seen as excessive, but this was not just in response to these commits, but also to the university's failure to act once they were informed of them.

They university, and indeed, the researchers, only acted once the ban was imposed - i.e. they were getting away with it without reputational damage, and only once it was stained did they actually do anything.
Yeah, it's not a great apology. I would say as far as justifications go, I think it's a certain level of depth expected from academics, you shouldn't overthink it.

As far as giving benefit of the doubt, it's likely not done out of malice in the first place. Just a combination of poor reasoning and doesn't exactly clear up if they even considered alternatives to control their variables. Unfortunately, it seems like they were already given the benefit of the doubt from their first offense, but did not take any lessons away from that, so it would be understandable if the maintainers kept their ban.
My parents are cover to cover times readers every day since they retired. Obviously they don't read every article, but they look at every page.
> What information exactly can you get from a debugger with watchable variables and immediate mode code execution, that you can't get from print?

If you have some completely undocumented object oriented code with tons of relationships, peeling the state apart in a debugger is a good way to get an idea of what you even have that might be worth printing.
I don't think so. It's malware, which means whatever it is doing, or trying to do, is not something anyone who has a copy of it agreed to in the first place, so it's impossible to argue, for example, that the security researchers are violating some kind of license or agreement that was voluntarily entered into in order to make use of the functions of the software.
To summarize:

-they apologize for the three patches in 2020

-they claim asking permission would have defeated their research

-they claim the other 200 were legitimate patch attempts (a sample of which were, from my personal reading, from 'innocuous but useless' to 'slightly harmful').

Hard to believe, but plausible.
You're the same idiots (no matter which side of the pond) who think covid is a plandemic, elections get stolen and scientists are paid to lie by a secret cabal of... you know what? Just GTFO.
> It does not come across as apologetic.

The words are there. It's not up to us to decide if they're "genuine". No one's a mindreader.

The tendency to view apologies as fake seems more often to reflect how harshly we view the one making it.
Double tap lock is exactly that on iPhones, used for payment.
They should have addressed why the kernel maintainers felt the way they do. As it is now they are trying to rationalize their actions instead of showing they have made an attempt to understand why their research was questionable.
> To write software and not license it opens the door for corporations or businesses with money (more money than you) to take your source code, redistribute it with their name on it, removing credit from you (the developer), and profiting off of your work.

In the US at least, if you don't apply a license to your work the default license does not allow anyone else to use it without your permission.
Huh, didn’t think I’d see the writer of The Northern Caves on the top of HN.

Back to this post: I’ve written some nearest neighbor code and definitely felt some pressure to make the API sklearn compatible. But I don’t think it’s as bad as the post claims in practice.

Highly recommend checking out the posters other work. Its a lot of fun,
Is this post actually research for an upcoming paper on apologizing to the open source community?
I really appreciate the apology and as they stated, its unconditional nature. Good.

However, I find something very problematic. This quote shows it:

"We have learned some important lessons about research with
the open source community from this incident."

This is something I don't like. This is not something about "research with the open source community". If anything, they should have learned something about treating human beings as persons and not as involuntary guinea pigs. They should have learned something about not breaking anyone's (not only any open source community) good faith and trust, and respecting that.

They behaved like jerks and they still cannot see that.
i find that my hands, toes and ears seem to be weak points. i might have to find some earmuffs that work with a helmet for next winter.

side note: i snooped your profile a bit and i'm intrigued by the path you've chosen. i am moving in a similar direction, and no doubt could benefit from referencing your experience...
Looking forward to the follow-up paper, "Open Source Insecurity: Concealing Vulnerabilities via Hypocrite Apologies"
Yeah, it's bleak. The truth is free computing and communications are subversive technologies. They allows us to lock them out, to evade their controls and laugh at their authority. They make laws, people make technology to get around them. With every iteration, the tyranny required to maintain the same level of control over the governed is increased. They won't tolerate these games for much longer. Even more importantly, technology allows us to effectively organize opposition to those in power and that's something they absolutely won't tolerate. Western governments are already surveilling even peaceful protesters.

I believe we'll eventually end up with ubiquitous technology empowering an ungovernable population or totalitarian governments that control all technology by force.
>> And no, none of the folks I'm thinking of actually make money from password management solutions.

Not directly, but maybe their peers do. If your buddy works at Facebook, you're not going to say bad things about Facebook's business. It also applies to some extent if it's your friend's friend; group-think is a powerful effect.

>> Your comment sounds the same as "of course all those doctors would recommend getting vaccinated since they make a profit from selling you the vaccines".

Well of course that's a factor to consider. The medical industry is not immune to ulterior motives. For example, doctors have been known for over-prescribing opioids and many people actually died as a result. I'm pretty sure all these doctors thought they were doing the right thing; all their colleagues were also prescribing the same drugs.

Also many drugs which received FDA approval were later found to be unsafe, caused birth defects, deaths etc... It's foolish to suggest that anything is 100% safe and ulterior motives will certainly have a negative effect on safety.
Or it's not in vengeance, but caution after the researchers have demonstrated that they put their needs above the community's. When the presumption of innocence is lost, it's appropriate to revert the patches until they are known to be good.

ETA: GKH on reverting the patches[1]

> This patchset has the "easy" reverts, there are 68 remaining ones that
need to be manually reviewed. Some of them are not able to be reverted
as they already have been reverted, or fixed up with follow-on patches
as they were determined to be invalid. Proof that these submissions
were almost universally wrong.

[1] https://lore.kernel.org/lkml/20210421130105.1226686-1-gregkh...
Interesting. Very holistic. Which is to say, not very concrete. Wink.

Did you follow the link I posted a few comments up, the "nine brutalist wonders of the architectural world"? Explain how those exemplify "just a box that people exist in"
"It is durable due to its incorporation of pozzolanic ash, which prevents cracks from spreading."

Third sentence in the Wikipedia article. Later:

"The strength and longevity of Roman marine concrete is understood to benefit from a reaction of seawater with a mixture of volcanic ash and quicklime to create a rare crystal called tobermorite, which may resist fracturing. As seawater percolated within the tiny cracks in the Roman concrete, it reacted with phillipsite naturally found in the volcanic rock and created aluminous tobermorite crystals."

Neither seems to have been 'lost data'.
> We are sorry for the harm we've caused by our unethical experimentation involving members of the Linux community. In accordance with community standards and a desire to avoid benefiting from our ethical failure, we have requested the immediate retraction of the papers and other published work resulting from this unethical experimentation. We are also working together with our institutional leadership to address the systemic and individual failings which permitted this unethical research to take place. As a result of this, we will publicly prepare a report regarding the actions taken and potential systemic changes which will ensure these actions do not reoccur and further harm is not caused. Out of an abundance of caution and because experience has shown our judgement, as is, to be questionable, no further research similar in nature to the research in question will be undertaken by this institution or these researchers until proper community consultation has taken place regarding the report and proposed changes to systemic review are implemented. Once again, we take full responsibility for any harm we have caused and we will work to ensure that such harm never occurs again. We hope that, at some point, we may regain your trust and confidence and, if you'll permit us, to work alongside you.

[signed personally, by every involved researcher, professor, IRB member, and all of the relevant university leadership including the board]

Something like that would do nicely, in my opinion. Then they'd have to absolutely follow through on it. Ideally, they'd also ask involved members of the community so harmed, among other experts, to independently review and watch the process to ensure no further harm is being done, progress is made, and public accountability is kept.
They couldn't put in a sentence stating what this actually does?
All the metal merchants I deal with here in Australia will issue quotes upon request, usually replying within an hour via email or immediately on the phone.

Prices are typically very stable, and they will notify of predicted significant price changes months in advance. We got notifications late last year of predicted price changes throughout the first half of 2021.
Does anyone else notice that many 'hamburger menus' don't work when JS is disabled? It would be considerate to use the <details> element to make a hamburger menu work with JS disabled, for that dynamic effect. Note: I surf the web with JS disabled by default, and only run JS on sites I trust (i.e not Youtube who are known to fingerprint you with webgl)
We have to remember that certain people were wholly convinced that Jazz in the early 20th century was evidence that the Jazz generation with all of its “degeneracy” would destroy civilization because the music in their generation was somehow pure or whatever.

And certain people threw absolute tantrums that Elvis and his gyrating hips on television was “cultural degeneracy” of the worst kind. Since they didn’t personally know anything of modern music they were sure that their generation had far better music.

Parents absolutely freaked out over packed stadiums of suburban kids singing along to Little Richard’s “Good Golly Miss Molly, you sure like to ball.” And you guessed it, they were crying about cultural “degeneracy.”

And certain people in the 60s and 70s stamped their feet in anger and shook their fists at the sky that Led Zeppelin was nothing but noise and the Beatles were admitting on television that they ...[audible gasp]... did drugs! They decried the “degeneracy” and that society was falling and that music hasn’t been good since their days when wholesome Elvis and Little Richard were popular.

In the 90s this group convinced themselves “degenerates” Marilyn Manson and Slayer and Rap were a sure sign that music was dead and that music hadn’t been good since the days when good music like The Beatles and Led Zeppelin were popular

Many in every generation are totally convinced that their generation was the last generation to make “good” music.

And perhaps more troubling, there’s a certain group of people who are obsessed with “degeneracy”
> As many observers have pointed out to us, we made a mistake by not finding a way to consult with the community and obtain permission before running this study; we did that because we knew we could not ask the maintainers of Linux for permission, or they would be on the lookout for the hypocrite patches.

This shows one thing to me, clearly, they still don't understand how such studies are conducted. not authorized penetration testing is illegal, to a very large degree.

For example, as far I understand, and as many pointed out; you get permission from members for an study without specifying time or any details of a study, then conduct study in 6 month.
Their opening statement has the most classic of all non-apology tactics: "We're sorry for any harm we caused". Maybe this wasn't their intent, but this is one of the oldest "say the words without having to mean anything" tactics in the book.

It's like telling your partner "I'm sorry if I hurt you". No, you hurt them. Apologize for hurting them.
I have several buddies who work at Facebook and i think Facebook is evil and one of the worst companies to work for in tech. They know my stance on it, now you do too, and I've disproven your opening argument.

I didn't mention opioids did i? I'm going to ignore further comments from you in this thread because this has all the hallmarks of a bad faith discussion. Assuming that's not your intention, maybe do some introspection on why that is.
> On browsers, it's at 73% native support on caniuse

Alternatively: it works in Blink, but nowhere else.
Because ipv6 is hard and NAT works well enough.
My general approach is simply to ask: what changed?

This assumes that I'm working with an already working system, but if I'm implementing a new feature, debugging is easier since I have more flexibility to explore alternative approaches.
That’s a thoughtful consideration. My logic is that a personal salting algorithm could be compromised after several points of failure, whereas a password manager can be compromised by a single point of failure.

The former requires trust in myself to create a strong algorithm, and the latter requires trust in a black box.
Segway solved the wrong problem; turns out that being self-balancing wasn't important at all. The real problem was parking/storage at the stops of your trip. The "shared" aspect solves that problem, making them a lot more usable.
If you view it as an improvement to your home, which increases your home's value, then it can make more financial sense than if you only look at the pure electricity savings.
Natural gas furnace. I probably would have gone electric if we had installed the furnace after the solar panels went in. But, our natural gas bill is so small that I don’t really worry about it.
From the electric motor.
Yes, my reaction entirely, I do a lot of real-time work, an interactive debugger is quite useless when stopping everything is not an option
that was a cool feature
> fire was the sacred possession of the immortals, and Zeus, the tyrannical king of the gods, took harsh revenge on Prometheus for stealing fire for the benefit of mere mortals

This, in a nutshell, is the ontological basis of the Western civilization's conflicted spiritual relationship with technology and knowledge. This notion -- fire stolen from gods which exact punishment -- is uniquely Western. (I grep'd OP for Mephistopheles and Faustus, which is related matter, but alas, the author had failed to make the connection.)

For the Western man, acquisition of knowledge metaphysically requires distance from, and ultimately denial of, God. It is not even remotely a surprise that this strain of thought unique to the West has reached its culmination in a desire for the disfigurement ("enhancement") of the Human body "made in God's image".
We're hiring.

https://twitter.com/AltheaNetwork/status/1357794950843305984

https://althea.net/careers
Its incompatible with IP v4, has a stupid addressing scheme, it requires new router hardware and software for isps to buy and nobody is using it because of all the aforementioned issues.
I'm no expert on the topic, but it looks like a protocol for interpreting hardware logic into a Factorio game board.
Huge "I'm sorry I got caught" vibe.
And it still refers to this malicious annoying behavior as "work" or "research", lmao
Very true. One launders money when the money is dirty. Money laundering requires placement of "raw cash", which is dirty. In this particular cash, the source of money is NOT "raw cash". Sure, Ihor took loans with the intention of not paying it back. This money is a product of corruption--not "dirty" though.

Imagine someone buying a new BMW M5 car on finance. Later, this guy claims that his car got stolen, gets a check from the Insurance company. Further, he uses this money as a down payment to buy a home in Texas. Do we call this "laundering"? I don't think so, since this money is traceable; neither placement, nor layering is involved. Yes, he schemed with his buddies to have his new car stolen, taken to Mexico. He can be prosecuted for his involvement in the theft, not for "money laundering".
hard work with outsized expectations is how your burn out a human. how you make them fragile & overextended in their beliefs, in a narrow dimension. teaching them that some one part of a vast equation is important is a horrible lie. it takes a lot of things.
Parsing /proc/net/dev in perl and displaying deltas with ncurses was one of my first teenage hacks (ca ‘97), ages before iptraf. This has been an issue for a long time.

This is a welcome change. Is the netlink interface described accessible in /proc or /sys with a standard fopen, or is it a special linuxism?