skysight-inc/HackerNews huggingface dataset:
> Now I feel bad about that.

Sure, you should pay for software when required.

But don't feel too bad. Note that even Microsoft realized that individuals and developing nations using software for free were expanding the market for future sales.

(In interviews over the years, MS spokesmen never focus on users that can't afford business software.

They (the SBA) did a few raids in Indonesian mall stores, where individuals really can't afford licenses. The average monthly salary at the time was about $100/month, and even today it's still around $200/month pre-corona.) But the raids might have been from having close relationships with the DEA and other US agencies moreso than the reach of the SBA by itself.

Also, large US companies know that site licenses and corporate sales are the real cash cow, with accounting and tax rules encouraging self-compliance.

FYI: What's interesting is that when I worked in Japan around 2005, all of the common desktop software was either Microsoft or Adobe at a very large company, with the odd internal program. (For servers, they were just switching from FreeBSD to linux.)
> Am I supposed to be shocked that photos the user uploads to iCloud are on iCloud?

I implore you to read the comment I originally replied in order to understand the context of my replies. Personally, I don't care what you're shocked about or not, as my OP wasn't directed at you at all.
There are BSD clones for smallish (small memory or even no real memory management unit) systems - RetroBSD and LiteBSD: http://retrobsd.org/wiki/doku.php , https://github.com/sergev/LiteBSD/wiki .
LEO is not alerted automatically, where’d you get that idea?
In Pop, if you add people to your contact list (or connect with Slack), you can see your contacts and team members' online presence, and can call them from within Pop.
If the supposed third-party scrapers can do it within a day, why wouldn't Plaid/Mint/Yodlee be able to do the same?
Very good breakdown of the situation. But cold comfort for anyone not in the USA. Because we know once Apple ships this it will be expanded to other countries with similar CSAM laws … many of which do not have robust Fourth Amendment type rights enshrined in their legal systems.
>it's a horrible strategy and will probably produce a net loss over time

I dunno. Too many variables to dismiss as horrible out of hand. For one, it depends on the actual companies involved.

Also depends on exactly how he executed it. If the stocks followed the typical average of 10% YoY gains as the rest of the market, then there's a way to execute this strategy wherein he wouldn't lose by definition. For instance, he might set a mark on the sell side to ensure he's not selling at a loss vs. his last buy.

Now, he might get stuck holding the stock for some time (especially after a big downturn) and that might incur him some opportunity cost. But, that wouldn't mean a net loss if he was willing to wait. And, that'd be no different a risk than, say, a typical buy and hold strategy.
Dunno how Turbotax does things under the hood in the US, but when it prompts me for the username and password of my broker to import my info, it certainly make me very queasy.
A hash collision allows you to create material that matches CSAM signatures, without being CSAM. This opens up a new class of attacks.

Specifically, many criminal actors don't touch CSAM because it's wrong. But some of these criminal actors will happily abuse legal systems, e.g. SWATTing.
Why does matter? The photo looks nothing like the target?

If someone looks at the two images wouldn’t they see they’re not the same and therefore the original image was mistakenly linked with the target
Most people wouldn't of course. In this scenario you'd get someone to download the CSAM unknowingly. If they have iCloud sync it automatically uploads to iCloud, thereby triggering the system. At that point the authorities will be alerted by Apple, and you can inform media outlets. They in turn will ask law enforcement who will confirm the investigation, and the reputation of the person investigated will be tarnished.
It's enforced - sometimes - by the bank. My bank provides read access to everything with a username + password, but to transfer money or update details requires an SMS confirmation.
Steampipe is a new project we launched in Jan 2021. Turbot is leading the build, and has been working with cloud APIs since 2014. We're bootstrapped, and have a lot less than 100 people, but are hiring (engineering, marketing, tech writing) if anyone would like to get involved :-)
I posted another comment that was misunderstood as well. Folks, no one is proposing to download actual CSAM images to your photo lib. You could be duped thinking you downloaded an image of a beautiful sunset which was carefully manipulated to match the hash of an actual CSAM image.
The governments always could do that, but then they'd be the target of the pushback, and there's already significant mistrust of governments wrt surveillance because of how it can be abused.

What we have now is Apple, with its "strong privacy" record, normalizing this. If it succeeds, it would be that much easier for the governments to tackle other stuff onto it. Or, say, lower the threshold needed to submit images for review. I can easily picture some senator ranting about how unacceptable it is that somebody with only 20 CSAM photos won't be flagged, and won't somebody please think of the children?

And yes, if it comes to that, Apple definitely cannot hold the line. After all, they already didn't hold it on encrypted cloud storage - and that wasn't even legally forced on them, merely "not recommended".
Taliban acquires biometric devices that identify who assisted coalition efforts
Let's be real, banks wouldn't see government regulation like this if something like Plaid didn't force them to have to implement more secure ways to get your own financial data.
You might be saying no because the comment is facetious, but the transition state being capitalism and communist bliss (communal ownership and no state) is in fact the Dictatorship of the Proletariat, which is fully centralized authority. The real trouble with communism (and arguably socialism generally) is that reducing centralized control has proven difficult in practice… similar to what happened here.
Also as dannyw pointed out, you don't even have to send CSAM to trigger the system. If they found you you would still be charged, but not with possession of CSAM.
There's no need for someone to get the entire CSAM database. If they go on the darknet and just find enough images (or hashes) that would trip Apple's system, that would be enough. I'd assume any publicly available image on the darknet would likely also be on CSAM.
Why is PowerShell a reason why the server OS is getting worse? It seems like a better thought-out alternative to the Unix shell, at least.
Jabbed adults infected with Delta ‘can match virus levels of unvaccinated’
This feels like something you'd find on linkedin.
> As you learn more about crypto and traditional finance, it'll be fun to compare the two. Your confusion about the role of an exchange in traditional finance might be because you see the crypto world, where a single entity often performs the roles that many entities perform in traditional finance (exchange, clearing firm, broker, etc.).

Yes, I agree!

In terms of what I called antiquated technology, I think there are a lot of layers on traditional finance, and a lot has changed since its beginnings. I think crypto will go through a similar evolution, in terms of tech, regulation, etc. I think we're in the very early stages for crypto and it has a chance to be an even better system.

I do know that HFTs exist in crypto, and it still is the wild west in some ways, but in the end I like that innovation is happening and that there are alternatives to existing systems.

That said, I appreciate all the responses and I'll take some time to learn more about traditional markets.
Oh wow, you hit on a major topic in my book [1]. The Altos were all networked, via 3 MB Ethernet. MazeWar was a networked game (or "MMOG" in modern parlance) and it's on the cover of the book. In the book they spend quite a bit of time talking (and trashing, for some old school folks) how Ethernet worked.

I actually don't remember any live chat apps, but that doesn't mean there weren't any; there probably were. We relied on email mostly.

[1] https://www.albertcory.io
This practice went on all the way into the mid-2000s at least (I graduated in 2006 and my SSN (which doubled as a student id) was printed on my student ID back then)
Free book on agent based modeling for civilizations from Santa Fe Institute
I’m curious if anyone who is on the leaked list now has standing in court to litigate their status, whereas they could not prove their status/data before.

One of my biggest complaints with national security programs is that they tend to argue that transparency (even to the voters and elected representatives whom these programs ostensibly protect) threatens the program. Sometimes when leaks happen, it gives the citizens a tool they didn’t previously have to challenge those programs.
I wouldn't call the UC384x "vintage"; they are still in production today. Likewise, the TL494/KA7500 was very common in PC PSUs and is still in production too --- perhaps you could analyse its die circuitry for comparison.

For schematics of power supplies using this UC3842 chip, see this site, near the bottom of the page.

Before looking at the URL I guessed it would be that site. The author is also on YouTube under the name DiodeGoneWild, and not surprisingly posts videos about SMPS electronics too.
This is the really scary part. Of course getting someone to download blobs that corrolate to CSAM would be one thing, but downloading regular photos that have nefarious hashes is a trend /pol/ could start in an afternoon.
You specifically said someone would be sent known CSAM. How would that get added to their photo library?
Yeah. "Not leaking data" is basically a pay-for way for Elastic to commercialise the tool. A pretty shitty way, I would say.
If you plant CSAM, you must possess, distribute, and transmit CSAM. That creates moral and legal barriers. The median ransomware actor probably finds CSAM repulsive and wrong.

If you plant material that matches CSAM hashes, you do none of that. The median ransomware actor might find this to thje fastest way to collect a thousand monero.

Also, you can distribute 30 media items per message via WhatsApp. There is a configurable setting for WhatsApp to save all received photos to your iCloud photo library. No exploits needed, you could probably weaponise this via an WhatsApp bot.
> Apple has pretty deep pockets.

For now, sure. What happens when their money runs short? What about the other tech companies that will inevitably be forced to deploy this shit? Will they also have Apple's pretty deep pockets?

Blind faith in this system will not magically fix how flawed it is nor the abuse and harm it will allow. This is going to hurt a lot of innocent people.
I have to say that I’m just sad about this. I was really convinced that Apple really believed in privacy and they will never do this (having a framework which can scan your device content). But maybe they already had it and this was like: “there is this delta and Afghanistan let’s make announcement now”

We are just one stupid terrorist attack from full surveillance of everybody.
Hit me up, email in profile.

Working on similar stuff, effectively what you have without the requirement to maintain scrapers.
I do wonder what happens in that case to the scan results for the photos that weren't yet uploaded. From earlier articles it sounded like the "voucher" is attached to the image upon upload, so it stands to reason that if you cancel an upload, results don't get uploaded for photos that didn't get uploaded. Who knows, though...
To defeat this, all you need to be is a state actor with a database of child porn at your disposal (which is stored for exactly the purpose of training detection systems). Then you run the hashing algorithm against images you know are in the database (Apple suggested that they would accept suggestions by some kind of multi-Country vote). Then you can pull out the hashes and figure out how to trigger false positives on the important vectors.

Next, embed your images in sites of interest, like:

* A meme in some group

* A document or 'leak'

* An email to a journalist

Wait for somebody to save it to their Apply device. Wait for it to be flagged and then use that as 'reasonable means to conduct a search'. When asking for a warrant, the agency would say something like "we detected possible CSAM on a device, the likelihood of a false match is extremely low" - a judge will hardly press further.

You now essentially have a weapon where you can search any Apple device in the name of preventing the distribution of CSAM.

Failing that, you could just have `document_leak.pdf` and download a file that is both a valid PDF and a child porn image, depending on which program you open it with.
You can't leave us without context! We must know!
The FBI off their back that they aren’t doing enough to stop the spread of CP.
Check out the PinePhone. While not exactly a “Raspberry Pi Phone” it’s pretty close to that in its basic concept.
I haven't read the entire report yet, but it seems like a step in the right direction (even given some of the caveats folks have pointed out). I work at Plaid and a big focus area for us is to move as much traffic to APIs as possible, with a target of 75% of traffic to be committed to APIs by EOY, and we’re hopeful that we’ll be close to a fully API based industry in the next few years. IMO anything that makes API-based connectivity and open finance standards more widespread is a win for both fintech developers and anyone with a bank account.
Devices with proprietary OSes spend more and more time phoning home, then exchanging data officially for "updates". They probably tell the truth, but should one of them decide to hide users data exfiltration or other monitoring practices behind those updates, it would be quite hard to catch them. In other words we have no way to tell that they're not already doing this.
That’s a lot of assumptions of good faith within publicly known constraints
Build your own acoustic phased array
Half a decade? Man, I was hoping for something better than header files in the 90s!
I find it hard to believe CSAM was so pervasive on iDevices that they'd feel compelled to do something about it.

As far as we know (and I'm sure lots of eyeballs are looking now) Android doesn't do this.

And frankly, why would Apple care that the FBI isn't cozy with them. Their entire brand is "security and privacy", kind of goes against most 3 Letter Agencies anyway.
> There will be someone along the line who will check that the image is, in fact, the actual listed image.

That someone will be law enforcement, and they will get a warrant for all of your electronic devices in order to determine if you actually have CSAM or not. It's literally their job to investigate whether crimes were committed or not. Those investigations alone can ruin lives, even more so if arrests are made based on the tips or suspicions.
I actually do agree - but two wrongs don't make a right here. Taking raw credentials from users without them knowing is completely messed up and a massive danger to the end-user. It's not justifiable in those terms.
China Blocks Fleeing Hong Kongers from Their Retirement Money
If Microsoft's scan is a server-side scan, how do they scan "everything" if "everything" includes things that you do not upload?

By your definition of "everything", both Microsoft and Apple scan "everything". (Or Apple will, after this new system is rolled out.)
> If you turn off iCloud Photos, nothing is scanned.

According to Apple. and For Now. Patriot Act was only for terrorists. Apple makes concessions for China. Creating this technology, makes it very easy for China to go, "Look at all photos, always". If they only want to scan stuff on iCloud Photos, no worries, just implement on it on their end. This tech does not need to exist in that case.

> Microsoft scans everything.

Everything uploaded to the Cloud. The Cloud bit is fairly important here. That's me, willingly, putting information on their property. Perfectly acceptable and fine for them to ensure that it's nothing unethical.

However, someone else snooping through your drawers looking for something to pin on you is not private, nor the same as checking their own property.
Just take the easy street finance money and find other ways to entertain yourself. FAANG gotta work harder for less pay and the work isn’t any more interesting.
I meant * could *. My point is that social engineering is a clear weak link in this system. They can also be sent regular photos whose hash matches the database, or use this repo to transform a regular pornographic photo's hash, making it hard for manual confirmation on Apple's part.
They're also locked-in to their own software. It's not just third-party developers using Metal, but first-party developers too. It would be nothing short of a massive effort, to shift the entire company from Metal to Vulkan. Make no mistake, this is what you're asking for. Choosing to support two graphics APIs? No, not gonna happen. This is why Apple deprecated OpenGL in the first place.

Nobody believes that Apple could just snap their fingers and start supporting Vulkan today. It just seems too optimistic to me, and these kinds sweeping changes require a lot of coordination. You introduce the Vulkan API internally (which takes time). Then you start with the various low-level frameworks, like Cocoa. With that base in place, you can write transpilers and migration tools to move from Metal shaders to something that compiles to SPIR-V. Perhaps a new backend to an existing compiler? From there, you work up the stack, applying the migration tools. Core Image is a big one. Undoubtedly, you'd have to back out the changes to some frameworks and try again. At the end, you're working on end-user applications like Final Cut.

You'll also want to build a framework on top of Vulkan to manage resources a bit. Metal has an Objective-C interface and works with ARC, Vulkan is all manual.

OpenXR is a lot smaller than Vulkan, and affects a much smaller number of applications. Not really a suitable comparison.

I would love for everything to use Vulkan, but I also understand the reasons why things didn't turn out that way, and why this is a problem that's not easy to solve.
The question I’ve been asking myself since skimming through the report earlier is this: Why should I take Facebook at their word for anything?

If the data is publicly available, then it can be verified. But until then, I don’t believe Facebook have the credibility to be taken seriously.
Please re-read my comments in this thread. I haven't said DO was obligated to have acquiesced here, in fact I've said that I would've taken their "no" and accepted it if I were in this person's situation, frustration be damned.

I simply think it's a poor move to judge one's financial situation and accuse them of asking for "free stuff" when, in point of fact, they were still trying to pay, albeit late.
The Gentle Way to Start with Quantum Machine Learning
I have a business account at Brex in Vancouver Canada BC and have been scammed out of $25,000.00 to access my account. These 3 people have been scamming me since March of 2021. I am constantly being charged for fees upon fees and more so because I am also a US based company. These scammers are Victoria Lindsay, Tom Anderson, and Sylvester Rowland. I have evidence of account information, email evidence, and payments submitted.

I have contacted Brex at support@brex.com and support-ops@brex.com many times and only get auto generated email response. No one from Brex has bothered to contact me for the details of those people that are scamming me from their company. Brex seem to approve of this behavior from these 3 people. Even reporting this to the Vancouver Police Department goes unanswered. Now I have to hire an attorney to settle this matter and help capture these scammers.
Have you tried the new math? The challenge is not a matter of the math, it’s a matter of formatting components of the answer in boxes. Without exposure to it, it’s nearly impossible to decipher. Which felt like half the point when I was doing it with my son.
Best decision they ever made. Now the rare chance I click on a Twitter link I don’t have to read it :) thanks Twitter!
Yep. Fwiw there's a similar recent YC company trying to solve the same problem:

https://beacons.ai/

(I'm not affiliated)

Seems like the natural progression. Silloed products store slices of user information (shops, media, text, etc.) And these products help unbundle and change the relationships so users have their own landing pages and can link to multiple sites they make money from. I'd bet in 5 years, there'll be a new company that scrapes data from beacons and linktree to offer search functionality across users...
Has it been net positive?

I feel like sadly no. People are more ignorant and unhappy than ever, this is such a wild outcome I would have never expected if you told early me that as I surfed the net happily in the late 1990s.

I don’t say this to be depressing, we get enough of that. I say it because I know some of you work in places and on projects where you can change it.
Bringing spouses to job interviews? Was that really once a common thing!?
The "new failure cases" it adds are rather exciting -- if the MCU locks up or glitches, which they are prone to, then it could short the supply rails and blow the switching transistors, or destroy the connected load by overvoltage. Analog control ICs, while they are not 100% reliable either, have many safeguards built-in that can react nearly instantaneously and don't depend on the relatively complex process of executing machine instructions.
Exactly, the phenomena are often way too complex for even a series of papers to come up with the proper abstractions to plan the right experiments. The history of chromatin marks is really illustrative of this. We had lots of early experiments to establish the antibodies to even measure the chromatin marks, and then then two decades of gathering enough data to lead to useful abstractions. And now it's all converging with the 3D organizational data from Hi-C experiments, and DNA methylation from methyl-Seq, and over the past decades the measurement technology (driven by DNA sequencing) has advanced so much that somebody in 2001 trying to anticipate this trajectory would be amazed. What was a single paper back then? Reproducible? Maybe, but that's much less important than pointing to the correct direction in this n-dimensional search space of what to examine next.

I've never looked at the historical literature from, say, 100 years ago, but I suspect that it's quite the same as today in all regards.

There's a ton of great ideas that never get the attention they deserve, a bunch of ideas that get way too much attention due to fashion or due to influencers that chose the wrong path. But who could we trust to chart a better path? Just like startups, we must accept a high failure rate when exploring the unknown.
Apple's reviewers, by law, cannot look at the target. No one except NCMEC is allowed to possess the target (CSAM material).

So Apple will be looking at a low-res grayscale image of whatever the collided image is, which could be legal adult pornography (let's say: a screengrab of legal "teen" 18+ porn), but the CSAM filter tells it that it's abuse material!

What would you do as the Apple reviewer?

(Hint: You only have one option, as you are legally mandated to report).
The "visual derivative" is not something any of us have been shown an example of either. Whatever it is, I suspect you only need to be vaguely in the same ballpark (I would wager humanoid shaped skin tones maybe).

So I suspect it would be easier then that (particularly since this whole hashing scheme has been surrounded with a lot of clear garbage - "1 in a trillion" -> on demand collisions in a couple of weeks?