skysight-inc/HackerNews huggingface dataset:
I think there's a mismatch between security and software engineering. Software engineers are paid to make things work, but the point of security is to make things not work (for attackers). So there is that fundamental mismatch which leads to a lot of strife, I think. (The real answer, of course, is that the software needs to do two things instead of just one. It needs to permit authorized users AND deny unauthorized users. One is not more important than the other, both must work perfectly. But when testing it, you're mostly happy when you, the authorized user, are allowed to log in, and so tend to forget about the "what if the assertion is malformed" case.)

I think it's funny because engineers are always portrayed as being grumpy and that they hate everything, but if you look at how they handle errors or security, they seem like the type of people that like everything and always imagine the happy path ;)
This seems dumb. I'm sure that sophisticated bad people will just alter colors and things to defeat the hashes and meanwhile trolls will generate collisions to cause people to falsely be flagged.
Very good article!
That too! It's restricted to Pixel devices though, and (I'm not 100% sure on this. It at least doesn't include it.) doesn't support things like MicroG which is a must for getting some apps that rely on Play Services to work correctly. I really think Graphene is only good for hardcore privacy and security enthusiasts, or for situations that actually require the security. I guess it just depends on how much convenience you want to sacrifice.
Inflation can be good. It causes the value of debts to decrease. However, sharp inflation in consumer prices without corresponding wage increases can precipitate a humanitarian crisis.
The FT article mentioned it was US only, but I'm more afraid of how other governments will try to pressure Apple to adapt said technology to their needs.

Can they trust random government to give them a database of only CSAM hashes and not insert some extra politically motivated content that they deem illegal ?

Because once you've launched this feature in the "land of the free", other countries will require for their own needs their own implementation and demand (through local legislation which Apple will need to abide to) to control said database.

And how long until they also scan browser history for the same purpose ? Why stop at pictures ? This is opening a very dangerous door that many here will be uncomfortable with.

Scanning on their premises (considering they can as far as we know ?) would be a much better choice, this is everything but (as the "paper" linked tries to say) privacy forward.
Yeah, the same way Dropbox is just a rediscovery of "an FTP account, mounted locally with curlftpfs, and then using SVN or CVS on the mounted filesystem", which obviously is also more flexible and fundamental than a single-purpose SaaS service...
Apple,

Not that you care, but this is the straw that's broken this camel's back. It's too ripe for abuse, it's too invasive, and I don't want it.

You've used one of the Four Horsemen of the Infocalypse perfectly… and so I'm perfectly happy to leave your ecosystem.

Cheers.
A CPI oracle on the blockchain would be nice to have (e.g. you could (try to) peg to CPI) but it does seem orthogonal from the data gathering and calculation part.
Per capita figures are meaningless. You're discussing imaginary lines in the dirt. The only way to tackle climate change is to bring down global emissions.
I've definitely seen this cultural bias towards SAML. I think it may be the case that a lot of enterprises have done a recent transition into Azure AD but have the same staff who had managed a legacy AD FS and have not adjusted with the times.

My approach has been to use Keycloak as an identity broker. It's implementation is quite robust and supports a lot of flexibility in terms of mapping custom assertions and the like. But the actual application "only speaks OIDC" and relies on access tokens to be reissued by Keycloak.
Have you tried the Chobani Extra Creamy? I now like it even better than Oatly.
i find that these extremist Tamils are pretty arrogant for such an ugly people.
> The GOP had to go with what they could get.

While it certainly remains to be seen, my (conspiracy?) theory is that a percentage of the payment to Cyber Ninjas will make it's way back to the GOP in the form of campaign contributions.
> However, what OIDC does relating to signing is far worse. In many OIDC deployments, the idea is you use something called “OIDC Discovery” [3] to discover the expected signing keys for the OIDC server. You fetch those regularly (e.g. daily), and do so over TLS. With SAML, you exchange certificates, and then rotate them every 2-3 years (with things blowing up on expiration), but with OIDC, you often end up using OIDC-Discovery, and thus can change keys daily.

I would bet a lot of money that a non-trivial number of people do exactly this in the real-world using SAML (Shibboleth: FileBackedHTTPMetadataProvider or DynamicHTTPMetadataProvider). It's not always manually managed.
A USD-denominated cost of living database? Plenty of sites out there doing that.
I have the opposite behavior on my macbook pro - Chrome can handle videos at 2x speed just fine, but Firefox will stutter or go sound-only for a few seconds if it heats up at all.
Yeah apparently. I have no idea why this is the case, but it definitely is. Google did shut down reader, but that didn't shut down RSS. It's hard to take down an open standard like that with just the end of one app.
Here the argument is that "suggested content" is popular, and FB showing it gets people to use their platform more, which in turn lets FB expose them to more (paid) ads.

That's different to non-direct payments for the "suggested content", which is what you seem to believe is happening.
This is a really fantastic series. It takes you through a journey from physics model of light, all the way to working ray tracer. I learned a lot about software modeling in general.

There are a few of these gems series available. I really liked the AI programming gems series.
A good start would be for the government to stop trying to bully tech companies into compromising on their privacy.
Setting `canvas.width` clears the canvas and resets all canvas state (stroke styles, transformations, etc...)

As far as I know, setting `canvas.height` is unnecessary.

Also as far as I know, using `ctx.clearRect` is faster, though it's possible the author wants to reset that other canvas state as well (which `clearRect` won't do), or it's possible there's some older browser incompatibility I don't know about that the author wants to avoid.

Edit: it looks like the author is also calling `clearRect`? Maybe there's some browser behavior I don't know about, but as far as I think this code is unnecessary. You don't need to do both things.
Serious question- how can anyone know these operating systems are truly secure? Is there a way to test the source code? From a code perspective could Google have placed a back door in Android to access these forks?
I work food service.
It's a bit more complicated than that. Tibet was internationally recognized as part of China - not as an independent country. After the Chinese revolution of 1911, China fell apart, and Tibet became de facto independent. But that occurred throughout China, as various warlords took control of different parts of the country. China was in turmoil (the Japanese invasion and near-constant civil war) until 1949. Once the country had a strong central government, that government immediately tried to reassert its authority over the territories that were de jure part of China, including Tibet. You can think of this what you want, but it's not at all similar to invading a country in the other side of the world.
Your friends aren't going to want to install an app to have it connect to trangus_1985's server. Be happy just getting them on Signal.
You're putting way too much emphasis on benchmarks vs real-world usage, IMHO.
>or even by taking a photo of their receipt after they check out.

Sounds like it'll be cheaper to buy the data off one of those receipt scanning apps. Better reach, and you don't need to make your own data acquisition/validation pipeline.
It's not fetishizing the rich it's acknowledging that they are entitled to the spend the money they've earned in the way that they want. Bezos wants to build a space company.

I'd like you both to pay the same tax rate too, 0%. You should feel entitled to keep all the money you've earned, so should he.

Bezos doesn't pay the rate you do because his income is lower than yours. It was about 90K/year. His has paper riches, stock. Which is worth nothing until you find a buyer and agree on a price.

It's surprising you mentioned companies not reinvesting in the context of Amazon, which is almost the perfect example of a company reinvesting all of their profits in pursuit of a long term vision. That's why Amazon never posts a profit, they just expand.
> Any idiot can legally fly an ultralight experimental aircraft with basically zero oversight. I don’t think you even need a pilot’s license.

But they have limits:

No passengers allowed.

No flying over towns or settlements.

No flying at night or above (or in) the clouds.

No flying in airspace around airports with control towers and certain other airspace without prior permission.

No commercial operations (for hire) except instruction.

Ultralights must yield right-of-way to ALL other aircraft.
There won’t be any collisions. It’s not a bit-for-bit Comparison. The algorithm uses machine learning to categorize images using perceptual match.

There will be many false positives, they will be reviewed by people. When there’s more than a few false positives, you will be investigated by the FBI.
hah yes this. the buffoon act really makes people underestimate- and if i dare say, sympathize with him. but he's much more competent (at getting what he wants) than people give him credit for.
Just to throw a few ideas in the room:

* offer integrations into various relevant systems

* ability to build custom baskets and/or change the weighting of different categories
Oh twitter. They used to have it way back in 2007 or so.
Openaps is a shining example of why open source medical device control is effective and necessary. Talk to the developers. Talk to the users. For every fear that "something bad is bound to happen" there are dozens of stories where bad things actually did happen because these tools did not exist.

The key to safety is that hardware itself a) shows the real state of things and b) has safety mechanisms in place such that even the most malignant control software would be no worse than poorly timed manual dosing.
> It's not doing any sort of scanning of your photos while they're just sitting on your device.

Yet. The point is the new system makes it feasible.
I think you are right, this can be done without a blockchain.

Once done, it could be useful to make an oracle with it and put it on ethereum so it can be used by other smart contracts. But not the calculation itself nor the original data points
Yes, and peoples with sublety understand what they "trully think" is not necessarily the true objective reality - which is why they don't bluntly declare it as if it is, and as if making it known is the only thing that mattered.

Which is why:

"This idea might not be good"

can be better than:

"This idea is BS"

Even if the second is more direct and is what you "trully think".

Because even if you "trully think" the idea is BS, that's just like, your opinion, man. The first formulation makes this clearer.

P.S. You can't complaint about me being curt here though, I blunty said what I trully think about this :-)
Fascinating. Want to know another secret about code quality? Custom software for banks generally sucks as well. That's your money it's messing with. am: "Let's try it in production" pm: We are going to need you to write a script to put everything back where it was.
I said, 'by default'. I know that it is possible to do a manual verification, but I am yet to have a chat with a person who would do that.

Also, the Signal does not give any warnings or indication that chat partner identify is manually verified. Users are supposed to trust Signal and not ask difficult questions
Is there anything stopping them from using an actual cryptographic hash, though?
My biggest bugbear on Android is the 1 min+ to load the first page if FF has been closed for a while.
You have to trust some people. Technical security reduces the number of people you need to trust and the extent you need to trust them.
They still have them.
I think you are saying with a password security policy you couldn't rainbow table the md5 of the password following the policy?

I'm not sure that's true anymore.

Without salts (which the third party didn't have) I'd assume many passwords the human mind can remember within workable policy rules have been compromised.

If the 3rd party had salted them, even with a common salt, the password policy probably would have worked though.
There isn't any reason to believe the CSAM hash list is only images. The government now has the ability to search for anything in your iCloud account with this.
It does change but it only removes the "mobile" part from user agent (through sniffing). But I think he's referring to a broader usage, for instance: MS Teams only works on Chromium-based browsers and Safari, so user agent change façade comes in handy for this.
Oaty is spelled differently too.

Total dick move indeed.
> Economic libertarianism saw some important activity near the beginning of that span, and its very confident anti-government and laissez-faire positions and language became very influential through the 90s, and it continues to grow.

That's true, but I'd quibble with the "it continues to grow" part. IMHO, it's peaked. It's still strong, but Trump and other populists dealt it a blow; and it's arguably now sclerotic "old thing" instead of the buzzy "new thing."
Lots of folks don't see Clojure as a Lisp.
Very much so. Source: I am 2/3 of the way through the book, and don't have any formal CS education whatsoever :)
So no OIDC for "internal" apps?

I had thought I'd missed something when setting up some customers, and having to refactor to use SAML for SSO where we'd used OIDC for g-suite, but you're saying unless I throw it on the gallery (public app store?), It's only SAML?
On Android.
> That is the whole point of decentralization...if one or two large pools (Ethermine and Sparkpool) get too big then they can sway proposals almost single handedly…

If the pool operators don't actually own the mining hardware then their power is limited to what the participants in the pool, who do own the hardware, allow them to do. If as an individual miner you don't like what your pool operator is doing you can always switch to another pool and take your delegated influence with you. Most proposals require supporting votes in many blocks before they take effect, so you have time to choose a more representative operator.
“Your idea is pure garbage” is very unprofessional. “I don’t think your idea is well thought out and lacks a clear plan” or “your idea is a terrible idea because of x, y, z” is much better.

“We’ll consider your idea” to avoid confrontation because of a bad idea is sugarcoating.
You can see the same pattern of two-step aggregation with the HLL_COUNT family of functions in BigQuery: https://cloud.google.com/bigquery/docs/reference/standard-sq...

This is really useful for this kind of metric (distinct count) that can't be trivially aggregated. It allows generating pre-aggregated tables containing the intermediate aggregation state. Now you can compute your DAUs, WAUs and MAUs from the same daily pre-aggregates.

I wish this design was generalized in SQL. For instance, getting the same family of function for variance computation would be super useful for efficient & correct computation of confidence intervals at different levels of aggregation.
Are you under the impression that people who teach logic are unaware of real world evidence that "things change and some of the those end up being bad"?
It's the thing itself.

Some designs are made by passionate talented people pushing the limits of their own skills and imaginations to explore what might be possible.

And others are made by mediocre people throwing some some minimal-cost low-effort derivative crap together to make as much money as possible.

One is an inspiration. The other is kind of offensive.

I suspect a lot of computer nostalgia is really about chasing that first feeling. I also suspect that's a lost cause, because you can't find the limits of imagination on the trailing edge.

Of course you can get echoes of it. Which is almost reassuring - but I really wish there were more high-skill high-imagination projects in computing today.
Here is a list of problems the blockchain space has improved, according to Ethereum founder Vitalik Buterin:

https://www.reddit.com/r/Buttcoin/comments/oac9lc/the_charle...
>* offer integrations into various relevant systems

What's your moat here? What's preventing a competitor from using the blockchain data you published to make their own product?

>* ability to build custom baskets and/or change the weighting of different categories

Considering that the data is public, that seems easy to do. See also: above comment about moats.
Well, "these kinds of approaches" isn't really a binary thing. When you're looking at a problem, you try a big mix of lots of different approaches - maybe you try making the problem smaller, and you get something that you could possibly crack if you made this extra assumption, and then your friend talks about their own unrelated work and you think "hold on, there's a bit of an analogy there", and you go back to your books and discover that a handy missing piece is actually Lemma 3.6 of some famous text, and you take a lot of showers, and eventually maybe the walnut shell has softened enough that you can peel a bit of it off.
This the same as: https://news.ycombinator.com/item?id=28078158
Think of the children!!!
> You don't have to be a malicious actors.

But with your nitpicking maybe you are?
Without capturing the equity component, this data is borderline worthless.
As far as is publicly known, only iCloud Mail was being scanned before this announcement. This is consistent with the lack of overall CyberTip reports from Apple historically (orders of magnitudes lower than comparable platforms).
In what way does the OP not understand what was implemented? This gives apple the ability to monitor any file on your device. Not only that, but all we have is the government's pinky promise that the database contains only CSAM. There is no verification. How do we know that it isn't going to end up filled with gay pornography involving consenting adults when the "feature" is rolled out in Saudi Arabia?
This client library is nowhere near enough by itself. I could tell this within five seconds, as it's a single source file only a few hundred lines long.

It checks that you get a signed assertion back, which is valid, and lets you pull out attributes. That's great, but there are a gajillion tags that can be set within an assertion that have genuine, important security implications and zero of them are handled by this library.

If your IdP sends those tags along with the assertion, this library will happily ignore them unless you implement support yourself. And I would bet heavily that approximating zero of this library's users write that support.

One trivial example, there's a `<saml:Conditions>` tag. This tag can have all sorts of attributes like `NotBefore` or `NotOnOrAfter` that specify a time period for which the assertion is valid. This library does not do anything to implement support for `<saml:Conditions>` tags at all, so every consumer of this library will happily process assertions as valid even if they're outside of the duration for which the IdP is claiming it's valid. If I get my hands on an assertion at some point in time, I can hold onto it and replay it forever to unsuspecting users of this library. There are other attributes that can set conditions, and there are other tags with implications on whether or not an assertion should be considered valid. None of them are handled.

Further, only minimal document validation is performed. The signature is checked, but the Issuer is not. Multiple Issuers can share a signing key, though I suspect actual cases of this are rare. At any rate, there's a billion ways users of this library can blithely chug along with an assertion that isn't valid and shouldn't be trusted, but nobody notices or cares because the happy path works.

With authentication, yes it's important that legitimate users are able to sign in. But it's as important that illegitimate authentication attempts are disallowed. And this half is completely forgotten about in literally 100% of the common SAML service provider libraries I've seen in the wild (which is admittedly not 100% of the ones available, just the ones I've looked at).

Edit: As @tptacek points out, every user of this library is trivially susceptible to AudienceRestriction authz vulnerabilities. An IdP can include a statement in an assertion that limits it to one intended service provider (e.g., "this document authenticates user FOO for Google service BAR"). Users of this library will simply see "this document authenticates user FOO" and authenticate that user, even though this document was never intended for them. Again it's been awhile so I might be mischaracterizing it a bit but that should be the gist.
Call me crazy, but if your 13yo is sending nudes, I think that as a parent you want to know that.

Current society is pushing a lot of adult behavior into kids, and they don’t always understand the consequences of their actions.

Parents can’t inform their kids if they aren’t aware.
I agree, humanity is just not equipped to deal with this crisis. We are not organized or disciplined enough. There are too many competing interests and whats worse, the problems are not human scale. (Meaning that people won't see the benefits of their sacrifices in their own lifetimes)

If I were a wealthy silicon valley type guy I would be looking closely at the Biosphere 2 project from the 80s and other closed ecosystem projects. There is untold wealth to be made knowing how to build and manage closed ecosystems, both here on earth and in space. There is a lot of science to do, and a lot of tech to build.

I would not be surprised if there were a number of secret ecosystem projects already underway around the world.
> the vaccine is more effective than antibodies from a previous infection

Unless you can cite at least one peer-reviewed primary source, then we must regard your claims as purely uninformed opinion.

And to further counter your claims, here is evidence that naturally acquired immunity is equally as effective as vaccination [1].

Quote from [1]:

- "The cumulative incidence of SARS-CoV-2 infection remained almost zero among previously infected unvaccinated subjects, previously infected subjects who were vaccinated, and previously uninfected subjects who were vaccinated"

[1] Necessity of COVID-19 vaccination in previously infected individuals
https://www.medrxiv.org/content/10.1101/2021.06.01.21258176v...
Thanks for that. It's hard to make out acronyms like "SWAV" or "SEER" from the audio, if you're not already familiar with them.
This has historically been fairly common among a lot of the early Elixir libraries, and I'd imagine that's a byproduct of many of the early adopters coming from the Ruby ecosystem, and not having prior experience with the patterns used in Erlang. I think some of the early confusion surrounding how application config should be used also led to some misguided decisions early on.

Fortunately it's something that I've seen improve over time, but it's a pain-point I've run into with a lot of dependencies, so I try to call it out when I see it.