skysight-inc/HackerNews huggingface dataset:
If https://old.reddit.com/r/msp/comments/ocggbv/crticial_ransom... is correct a compentent web application security review (white box or black box) which was correctly scoped to include the affected files would likely have found the SQLi and authentication bypass issues (mentioned in update 12)

Without seeing the codebase in question, you can't be sure, but having been a web app pentester for 10+ years, these are the kind of issues that were found regularly, and whenever I saw classic ASP in tests, they were the kind of issues I'd be looking for, knowing the inherent weaknesses in the platform.
Yeah I think people really underestimate how massive of a security liability node modules are in the way the system currently works.

Fixing it should really be given top priority, but doesn't look to be a very popular subject when you compare it to some of the others such as whether or not ESLint should become a NodeJS core module ...
this did occur to me while reading the post - why not just generate assembly from the specifications? What's the point of the intermediate translation to C?
No, open source Audacity audio editor is not “spyware”
You can link a file that is outside of that directory and thus get write access to that file. (Canonical example is linking /etc/passwd somewhere where you expect root to do chown -R you .)
I’m beginning to think this line of advocacy is a red herring. If we’ll-endowed entities like nation-state backed ransomeware attackers want to completely ransack companies with nine figure budgets, they will always win.

To me, this is more of a foreign policy issue. I’d say the damages caused by an attack like this can be requantified in loss of American life, and treat it like such. What should we do if Russia were killing 20 US civilians every few weeks?
how is this different than a broken clock being correct twice a day? by this I mean to say, just because some predictions made using some models turned out to be correct, why does this validate those or all climate models as accurate predictors of the future? the system is so complex, poorly-understood, infinitely fractal, with endless variables depending upon each other in ways that we mostly don't understand... the models are so varied, based on different data sources, some omitting entire classes of data entirely... I would be more surprised if some predictions some models made didn't end up being true after several years. but that doesn't mean they're useful at predicting things going forward, by any means.
Banning isn’t enough. They must somehow be destroyed or rendered useless, perhaps through a mass 51% attack or something.
Or how about we just end this culture of legislative micro-management, so that we don't have the problem in the first place?

From there, we can give the agency the budget to do the job, and let someone who's actually close to the situation decide whether it makes more sense to contract it out or build an in-person team. A bunch of legislators who are well-known to be perpetually too busy conducting fundraising lunches with lobbyists to actually read the text of the bills they're crafting and voting on are never going to be making informed decisions on matters at this level of detail.
Submissions from this domain are automatically killed. Do you have "showdead" enabled in your profile settings? Because this is what the from-list looks like for me using showdead=yes:

[dead] US Seizes Several Iran-Linked Domains in Fight Against Alleged Disinformation (dailycaller.com)
[dead] Washington Post Edits 15-Month-Old Headline (dailycaller.com)
CNN Loses Nearly 70% of Its Viewers Since Trump Left Office (dailycaller.com)
Man Who Brutally Beat 65-Year-Old Asian Woman Is Convicted Murderer on Parole (dailycaller.com)
[dead] Georgia SOS and Washington Post Lied (dailycaller.com)
[dead] Did Coronavirus Come from a Lab? Ten Key Takeaways from a Shocking New Report (dailycaller.com)
‘Smoking Gun’ Biden Email 100% Authentic, Forensic Analysis Concludes (dailycaller.com)
[flagged] [dead] NY Post’s ‘Smoking Gun’ Hunter Biden Email 100% Authentic by Forensic Analysis (dailycaller.com)
[dead] Apple Developing Search Engine as Google Comes Under Antitrust Scrutiny: Report (dailycaller.com)
[dead] The Green New Deal Can't Break the Laws of Physics (dailycaller.com)
[dead] Facebook’s Cyber Security Team Blows Whistle, Says They’re Victims of Automation (dailycaller.com)
[dead] Ex-FDA Chief Scott Gottlieb on How Beijing Misled the World About Coronavirus (dailycaller.com)
[dead] School District Implements Busing, Chinese Immigrants See Communism (dailycaller.com)
[dead] America’s Federal Budget on ‘Unsustainable Path,’ Warns Fed Chair Jerome Powell (dailycaller.com)
[dead] Google Working on a Secret Project to Collect Personal Health Data on Americans (dailycaller.com)
Relevant to the link. For once if you look at the site comments, it doesn’t include 200 Bitcoin maxis calling FUD defending it. You get the opposite.
DOD cancels $10B Jedi cloud contract
Scribie | REMOTE

I am the solo founder of Scribie, an AI powered audio/video transcription service. Scribie originated as kind of a rebound project after my first venture failed. I just decided to put my head down and focus on building the product this time around. It worked and the business started growing. Scribie consumed my life for next couple of years and I was working 80+ hours per week doing everything from business development to writing code. I loved programming and I was having a blast. However, I made the bad mistake of falling in love with my product. It was my baby and I never allowed it to grow up. I have now fallen out of love. So after 13 years, here I am looking for a co-founder!

We are in a fast growing market and we have a good product (we did 1M in revenue in 2020 with zero sales/marketing). I think this is the right time to pivot to a traditional SaaS product. Given that others are at 100M ARR mark with similar products, we can definitely do much much more. I'm just looking for the right guy to execute this pivot.

I can be reached at rajiv at scribie dot com. Learn more about me at https://archive.is/CbCsi.
Common cosmological and philosophical threads run through all religions, but some tenets of Neoplatonism and related Hermetic mystical foundations made their way into Catholicism through two means: early Christian cults and sects before an organized central church ruled on all tenets, and later through Augustine and Aquinas saying "these guys aren't so bad, they figured out why we know there's a god at all and now we can prove it".

Neoplatonism well predates the church. It's beautiful, though.
It has to be a credible threat
Apparently if you sell someone an airplane you're on the hook for 18 years of safe operation.
Startup Plans Aneutronic Fusion Reactor (WARNING: sketchiness)
Not really. If you look at the chart, there was a huge spike in trading the moment the news broke, which then dropped it .4% instantly. That's not normal.

FWIW the stock is now back at what it was before the news broke.
> Exactly, from technical perspective it's a nothing story.

I think that one thing it points to is how technology can discover novel iterations on a system. Imagine if this was a system modeled around a network and the agent was trying to figure out how to get from the outside to read a specific system asset. With the right (read: very detailed) modeling you could create a pentesting agent.
You can, on a local level, push for the American Anti-Corruption Act.

"In cities and states across the country, citizens are using a piece of model legislation called the American Anti-Corruption Act to root out conflicts of interest and corruption where they live. Time and again, history has seen laws passed at the city and state level make it all the way to Washington and turn into federal law.

Local Anti-Corruption Acts and Resolutions build momentum towards national reform, since politicians running an anti-corruption platform seed Congress with representatives, not pre-purchased by special interests."

https://represent.us/action/is-lobbying-good-or-bad/
What do you consider to be catastrophically incorrect?

If the model predicts that a glacier disappears in 2050 and it disappears in 2070 instead?

Or if the lack-of-model makes a lack-of-prediction about glacier disappearance, and then it disappears in 2070 by surprise?

Error accumulation makes sense to worry about if you're planning a voyage and worried that dead-reckoning navigation will leave you kilometres off course. But if you're on the voyage already, out on the open ocean, you can argue with the navigator's math but you still need to navigate -- you won't do better by just blindly insisting the boat never left the harbour.
How to make cheap West Texas land worth even less: Build homes on it, but don't include garages or driveways; instead tell prospective buyers that they need to keep their pickup trucks outside of town.

EDIT (as I feel I was overly snarky): I don't think there's anything wrong with thought experiments like this, and I've wondered to myself what a brand-new city or town might look like. I do think the no-car thing would be an incredibly hard sell in rural Texas though. The reality is that most modern towns aren't self-sufficient. Maybe there's a dentist, or maybe you have to drive to the next town over for one. Maybe there's a used sporting goods store, or maybe you have to drive an hour to one when the kids grow out of their cleats, etc. I think something like this would stand a better chance if it were right outside of a city. Maybe an old farm in what is now the suburbs - you could build a dense, walkable town that also connects to the big city via mass transit.
"The attackers were able to exploit zero-day vulnerabilities in the VSA product to bypass authentication and run arbitrary command execution," the Miami-headquartered company noted in the incident analysis. "This allowed the attackers to leverage the standard VSA product functionality to deploy ransomware to endpoints. There is no evidence that Kaseya's VSA codebase has been maliciously modified."

This is very likely not the full story, unless the 0day in VSA was somehow wormable. That "deployment" is doable through overly permissive IAM and everything else that enables privesc.

There are two parts to these vulns. Whatever gets the foothold, and whatever allows privilege escalation. Audits do a great job in catching the misconfigs that allow privesc.

The tragic thing about these attacks is often the blast radius can be contained fairly easily by asking the right questions... If you're someone who has passed these audits, or done these audits, it becomes pretty easy to see how many unforced errors go into these catastrophic attacks.
This doesn't get rid of middlemen, though. Blockchain is not truly peer to peer. It relies on blockchain nodes, which you can run yourself, but mostly people don't do that, and it isn't free to do. The reason users of the blockchain don't currently have to pay anything to use it is that owners of blockchain nodes earn money by holding coins that appreciate relative to their local legal currency at a sufficiently fast rate that they don't need to charge their users.

That doesn't seem like a permanently sustainable business model. Coin values can't keep shooting up forever, and at some point blockchain node owners are going to need to either shut down or directly charge blockchain users, and then you're back to the same situation as normal payment processors.
Previous discussion: https://news.ycombinator.com/item?id=27750770
Hitching a ride on a fast-moving extrasolar object passing through sounds good, though it seems like finding one going the right direction (and with enough time to get aboard) would be tricky. I suppose once you landed on it you could try and alter its course with mass drivers, but of course the more massive it was, the harder that would be.
> Do you have "showdead" enabled in your profile settings?

No
What a completely useless and patronizing comment
Might also have something to do with the explanation size: this Poisson thing is one little thing. With the internet, it's perfectly acceptable to just do a blog post on one little thing.

Previously, if you were to write a textbook or teach a tutorial, you needed to teach a bunch of things.

So in the internet age there's a bunch of fine grained "best explanations" coming from a variety of authors that beats the best that one guy can do across a range of topics.
That's all true, but we should also be willing to pay more in the public sector. Capping government salaries and then paying for consulting is an especially lousy form of privatization.
Love this idea. I just went through a painful search for someone and finally found a good match (I think), but it would’ve been fantastic to have this a few weeks ago. I look forward to trying it out sometime
I think this is true in a lot of industries. I was in the music industry and I quickly learned that it is about hustle and hype more than quality players or songs. In larger companies it is the people who play the "office politics game" that get ahead more than people with skills or good ideas. Such is life.
Code is not a prose. C-like syntax is much easier to read compared to Ada/Pascal's text blobs.
Portions are the #1 culprit as far as food goes, I'd say. There may be a bunch of other factors, but I'd expect that they're secondary to that.

I'm also very curious how much better US health would be if we could wave a magic wand and replace all sugary drinks with water. 64oz of sugar-water with a meal is a lot, but not uncommon thanks to free refills and helpful waiters always topping everyone off. Lots of people have way more than that on an average day, too. I'm sure it wouldn't fix (anywhere near) everything, but I bet that single factor is an awful lot of the cause of dietary-related illness rate differences between the US and other countries. The others have soda too, but it doesn't flow as freely and cheaply as here[0], and enormous cups/bottles of the stuff multiple times a day isn't common most places.

[0] With some exceptions—I understand Mexico, for example, consumes lots of sugary soda.
Interesting you bring this up. A counter example would be what's happening in Balochistan. It has a majority Muslim population, is India forme ting separatism there too?
The usual attitude of regressive red-state governments towards cities pursuing left-leaning ideas (raising the local minimum wage, relaxing zoning, building municipal broadband infrastructure, etc.) is to make it illegal for cities to do those things. So I find it odd that Texas is the location for this thought experiment. If these plans were put into action, the state of TX would probably pass laws and regulations requiring things like minimum amounts of street parking.
> America definitely has this puritan streak of trying to be the best person you can be - or the purest you can be. Work harder, drink less, exercise more, etc.

That might describe some parts of America, but it's definitely not universal. The German immigrants that formed the generation before me were drinking more and exercising less. They were also farmers, so they didn't need to exercise.

I would argue that it's the heavy influence of immigrants from all over the world that caused the self-help obsession. Those who came here weren't a random sample from their home countries. Immigration was itself a form of self-help.
This reminds be of the "No Fear" series of classics which really helped me get into Shakespeare. What I usually do with stuff like this is read the original, read the translated/simplified version, and then finally read the original text again. I find that this method really helps both reinforce the meaning as well as appreciate the beauty of the original language.
So each tool can stack on top of another tool.
As a Canadian and a French citizen

If I may hazard a guess: Quebecois?

I lived in Toronto for a few years, with the occasional trip to Montreal. I definitely noticed a cultural difference between the provinces—Quebec was rather less stressed out, whereas Ontario is just as tight-assed Protestant as the Midwest. (Maybe more so. Can’t buy wine at a grocery store? Raw uncut Calvinism.)
I wonder if this is meant to show a lack of impact on Microsoft's share price? Because I can't imagine any reporter at CNBC thinking that a drop to levels last seen on Friday lunchtime is notable.
Windows 11 as an OS won’t require a camera. It’s a requirement for vendors to be allowed by Microsoft to put a "Designed for Windows 11" sticker on the hardware.
Maybe because people like you bring up a weird stance that isn’t objectively true snd likely not true to the majority of Americans. WaPo is centerist neoliberal in reality, but Americans likely view it as to the left and liberal. But nothing wild. They aren’t going crazy for Bernie or Ilhan Omar. They certainly are not talking about people to the left of them. Who would be far left.

Your point really breaks down when you would have no way to classify thoughts and media one or two or three steps more to The left of WaPo. Even if you add “radical left” for one spot further to the left. There’s nothing else after that.

Or you’re taking the stance of Fox News and co. who will dishonestly wonder if Biden is a socialist.
My personal experience has been at at all such online/offline places most people there are ones with an idea/WIP who are looking for folks to join them.

I've rarely met someone who wanted to join other's ideas/WIP. Which makes for an interesting dynamics and a very low success rate.
>I'm interested in seeing the problems solved, and I'm indifferent to technology.

I think the first problem is some kind of language specification. That it's not possible to know what behavior one should expect from rustc means that it isn't a solution. It's another problem. You should check out Ken Thompson's great speech on why this is an issue. https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...

Or do you think it's wrong to regard unauditable enhancements to free software paid for by Google with suspicion?
“I Signed Up to Write College Essays for Rich Kids”
https://en.wikipedia.org/wiki/2020_United_States_federal_gov...

https://www.nytimes.com/2020/12/17/us/politics/russia-cyber-...

Government doesn't care about the security of your personal information, hence why they treat their security engineers with contempt by offering them paltry wages and drowning them in red tape.
Based on my experience on multiple internal Red Teams this is more or less correct.

Add some funding / IT cost center, no value add language in there as well.
> Ultimately, you gotta take the peanut gallery with a grain of salt.

The difference is that Dropbox was a prediction about a business model, while the anti-blockchain comments are assessments of a technology.

A lot of the bullish claims about crypto are based on badly misunderstanding the underlying technology. HN is not predicting anything in that case, just debunking misinformation.

> Decentralized finance alone is already a 100 billion plus dollar industry and growing at 5-10x a year.

You're changing the topic. This thread was about decentralized, blockchain-based apps, not about decentralized finance.
The flip side of this is that plenty of enterprises come and go without us noticing. You might have 222k enter and 249k exit in a quarter. My point is that ransomware at the b2b layer could shutter 100k businesses and it would be hard to distinguish from normal.
What’s Next for the Campaign to Break Up Big Tech?
I think you're hierarchy is fine, but keep in mind the Baltimore catechism is not an 'official' church document issued by Rome.

As something issued by all bishops in the USA, it did at one time have official status in dioceses within the United States.

But it's not a place to cite 'official' Catholic teaching, because it's not a universal Church document the way a church council, a vatican statement, or the writings of one of the church doctors would be.

It's best to cite a source that the Baltimore Catechism would have used as the authoritative source.
> now as a founder who is building a tool to collect telemetry in the most respectful manner possible.

Thank you for taking being respectful to users seriously.

I'd be very interested in learning how your consent flows look, and what other aspects of your product are driven by the goal to "collect telemetry in the most respectful manner possible". I couldn't see much on it on the landing page, so if you have a moment, could you provide additional information, either here or in private?
So who’s next? ConnectWise? Atera? Ninja? I’d be shitting my pants if I were running any of those right now.
I'm very invested in urbanist discourse (which is to say, all things that lend themselves to less cars and more people doing more walking/biking/transit). That said, the fantasy of building a human-scale town from scratch is, unfortunately, a fantasy.

The author is half correct in saying that we've forgotten how to build towns. It's better to say, the creation of new towns have become economically obsolete. Their niche is gone. Historically, towns formed organically around sources of value, such as farmland or rivers or mines or whatever, where many people making a living in the same region benefited from being in walking proximity, which enabled commerce. That concern just doesn't exist today, due to cars.

You don't need a town with an inn when the truckers stay at motels and rest stops. You don't need a town square when people shop at the big box store on the highway and local producers are part of a complex global supply chain.
Its interesting to me that the discussion around ransomware attacks on HN is full of victim blaming.

When stores are forced to close in SF because of rampant theft, nobody suggests that Walgreens or Target should hire armed guards.

If a mall were to be bombed, nobody would suggest that malls should just be built to resist bombing attacks.

The entire point of a government is to provide security and protect the rights of citizens. It is the government's job to solve / prevent / deter crime. If we are willing to put the burden of security on the individual, then why would we organize into states at all?

I think there could be "IT security codes" just as there are "building codes" to enforce security good practices. But "survive impact from a 747" is not part of our building codes, and similarly "be resilient to targeted, state sponsored cyberwarfare" should not the responsibility of the individual.
see also: https://news.ycombinator.com/item?id=27739596 [Audacity: Clarification of Privacy Policy]

https://news.ycombinator.com/item?id=27741910 [Audacity fork without any sentry telemetry or crash reporting]
This backend is now sufficiently mature that the Rust Compiler Team is discussing upstreaming it (just the Rust part, not libgccjit itself): https://github.com/rust-lang/compiler-team/issues/442
> I mean there are kids becoming mil/billionaires on blockchain dApps overnight

Which dApps? How many users are there? And why can't that dApp be built on traditional stacks?

> building real value

Haven't seen any of this yet. I've seen speculation on coins, and then there are many layers of financial products built on top.

The application space is essentially non-existent as a use-case.
Anthropogenic Global Warming is great for plant life. The world is greening right now, and that's great for food production and lowering world poverty.
If portions are the problem then processed food should be fine, why is it that processed food always comes in larger portions?

Why do consumers often think that the smaller portion is more filling when eating a properly proportioned french meal than the equivalent calories from McDonalds?