skysight-inc/HackerNews huggingface dataset:
This is a pretty thorough and high profile hack on a major tech company - this isn't something I'd expect from an Amazon owned property. The hack (allegedly, I haven't downloaded it) includes

* Entire git histories

* Internal/Private AWS SDKs

* Encrypted Password dumps and payout reports

It's so comprehensive I'm very curious into how an attacker got that level of access. I can't think of another, large, corporate web 2.0 startup who's gotten owned in a similar fashion. Could the same attack work on Amazon? YouTube?

It's also strange that someone who has this level of access to what is presumably a multi-billion dollar company decided to just leak the data? Maybe they did try to ransom it, but I'd imagine someone with this kind of access inside Twitch must have had some creative way of making money.
Responding to a deleted but interesting comment. Normally I wouldn't do this, but it's harmless enough:

> Backblaze B2 transfer to Cloudflare is free egress due to bandwidth alliance and Cloudflare CDN is free egress.
So you already kinda have that.

Hmm... What does it mean to transfer to Cloudflare? That's interesting.

I want free egress to my Hetzner servers. (4x16TB for $79EU/mo is unbeatable, primarily because Hetzner also has unlimited free egress bandwidth.)

But if Cloudflare offers servers, I should look into that. Do they? Even if they do, what's their egress pricing?

Thanks for the tip!

(I've been wondering about B2's mysterious "computing partners" -- their computing partners get free egress, so it seems entirely plausible that Cloudflare might be one such computing partner. I just didn't realize that Cloudflare might do computing at all -- in my head, they were a proxy, not a server farm.)
Audits.

(And yes, I've worked for companies that deal with lots of data that has strict retention limits by law, and oh boy were there audits and oh boy are you in trouble if/when you screw up)

As for your proposed solution: I don't think I understand what you mean. Could you expand on it?
I don’t know how you can look at the telecom market and make the determination that it’s “unfettered capitalism”. AT&T has an extraordinary amount of special market privileges that shield them from competitive forces. Almost all utilities are quasi-government. That they are allowed to own private infrastructure on public land, sometimes at no cost, is something you or I could not do. Am I unaware of an important counterpoint where Soviet telecoms were high functioning and free of perverse incentives?
Interesting perspective. Was the author of this blog post still involved at the time? Or was this after his departure?

Having the CEO try to dunk on applicants during interviews is not a great sign for any company.
Didn't the British abolish slavery before the US?
They should have nothing to do with payments? And yet their first product is so vastly superior and more secure than any product offered by banks or card providers, tell me how keeping the status quo with plastic cards is better.
I could see an argument that the card is a license key for the functionality activated by it.
Build more housing, make it tall, with enough bedrooms to start a small family or live with multiple people.
More discussion here: https://news.ycombinator.com/item?id=28770590
Why is this a regression in iOS? Changing the user-agent string is not a regression.
I think these are precisely the arbitrary cultural distinctions people are arguing about. I too feel that the difference between pink and red is categorical whereas that between pale and dark blue is mere nuance. Apparently Russian speakers feel about dark and pale blue as I do about red and pink.

I am a linguist, so I've been aware of this debate for quite some time, though I've never followed it that closely. What I don't understand is how anyone operationalizes this notion of "basic color terms". English has hundreds of color terms at least, but the "basic" ones are supposed to be white, black, grey, red, green, blue, orange, yellow, purple, brown, and pink (I don't think I'm missing any). People agree on this list and accept it. They agree on a different list for Russian, adding one more, which is roughly cyan. They agree on different lists for Xhosa and Nahuatl and so forth. But how do they come to agree? I agree that the list given for English feels right. Is this all they do? "Does this feel right? Yes." That seems like a weak basis for such a long-term debate. On the other hand, much of the evidence argued over in linguistics is of this nature. "Does this sound odd to you, other linguist? Yes. Data!"
In the first case the request worked when executed in Postman but failed when executed from a browser, which said it was a CORS error. Using the logs we traced it up to the authorization step in APIG, which wasn't being executed (because auth header was required to execute it) and so wasn't generating logs. And that's where I was stumped, because it was not a part of my mental model that request headers could disappear between client and APIG. We eventually realized the browser uses the proxy and postman doesn't, so we asked the networking group and they admitted they were removing the auth header in the proxy.

Regardless of the details this is one of those situations I wasn't able to solve by just thinking about it. If I had a 'debugger' that could step through these API requests it would have been much easier to figure this one out. I don't know enough about OpenTelemetry to say if it would have helped or not.
> The only thing worse than startup leadership quarrels is watching one of the founders turn around and try to sink the company by airing all of their dirty laundry on the way out.

Wait, why is that a problem? Let all be aired and let us figure it out for ourselves. We're all adults. If the situation is indeed as the cofounder claims, a cleaned, distilled version of events is untruthful and patronizing.

And if the events aren't as claimed, startups are evaluated on their ability to hire the right people. If the CEO chose a cofounder who would lie and destroy the startup for no good reason, then that also reflects poorly on the CEO.

I, for one, appreciate the signal that Wasmer is a startup to avoid doing business with
I have heard great things about SaaS Pegasus. The creator, Corey, seems to be dedicated and push updates pretty frequently. I have no affiliation with them, just things I've observed.
I have more than 8 cards, but wasn’t aware this limit was even a thing because there’s no reason for some of them to be added to Apple Pay or carried around. Like the Amazon prime card, which exists only to be used on Amazon or various rotating category cards, of which typically only one or two of are useful at any given time and are used almost exclusively online.

Not to say there’s no legitimate use case for 8+ cards in Apple Pay, but I’m having a hard time envisioning it.
90 days only we will backfill at some point but we need to test a bit more
They should ban facial recognition though, in all and every context where the owner of the face has not given explicit consent. Nothing good can come of it.
But then they become educated and you are back to the initial problem: the motivation!
for some reason, this reminds me of this question that occured to me. How could we design some sort of error correction/encryption algorithm which makes the information impossible to encrypt.

If we consider error correction to be the capacity for a message to resist errors, and encryption as the design of reversible error for any possible message (to add the error is to encrypt and to remove it is to decrypt).

Then, how can we make an error correction scheme so good that a message encoded with it can be error corrected back into the original regardless of how the encoded message is encrypted?
I mean, I guess you could say the pyramids were built with green energy. It's a strange twist on slavery, but creative.
I think that when CF say unlimited bandwidth they really mean it. I manage a domain on the business level plan for a domain and I pushed over 1PB through it in January. Not a single complaint from CF and no sales calls pushing enterprise tier.

They haven't clarified their file operations costs yet though. That could get pricy but will more than likely be cancelled out by the egress savings for most use cases.
Direct air capture sucks carbon right out of the skies
You can run the same query with a query builder here
https://play.axiom.co/axiom-play-qf1k/datasets/github-issues...

I changed it to 90 days :D
How is Cloudflare gonna coup up the price? These numbers are too good to be true (Sorry I am naive in how egress pricing works).
Philosophically? Sure. But with how the masses act and behave and take interest in, getting the critical mass of non-technical people you would need to make it work is a massive hurdle.

Facebook, Twitter, YouTube and Reddit will skate by with inertia for years to come no matter how suicidally they behave because they have mass appeal. Losing one audience doesn’t matter because they have millions of other audiences. You start up a social network that interests mainly technical people and the journalists that report on them, well it’s just not going to thrive because after the honeymoon period is over, the network just starts to look stale and slowly die off. E.g. Google+.
universe doesn't follow a straight path to optimal.. only locally optimal bits.

what if ICE never took off and we spent 100 years developing electric vehicles ?
Hi, I'm LV, I wrote this post. I co-founded Taloflow to make choosing cloud vendors transparent and easy.

I'm curious to hear what factors HN readers think I missed and if you think Cloudflare R2 will be a threat in the cloud object storage market place.
>The harmful products identified by the researchers included interactive baby dolls being sold on eBay that contained a restricted chemical, and a remote control helicopter on Amazon that broke easily, exposing button cell batteries that are extremely dangerous when swallowed.

Oh the horror... Cheap helicopters and batteries. Of course this danger is no doubt reflected in several fold increase in child mortality [0], won't somone think of the children!

>Its campaign is being fronted by Sam McCarthy, the mother of three-year-old Rebecca, who almost died after swallowing brightly coloured magnets bought from a third-party seller on eBay that she mistook for sweets.

Who gave young Rebecca an eBay account? Completely irresponsible, she couldn't know what she was bidding on! Thank God this responsible mother here is around to warn us of the dangers.

https://www.statista.com/statistics/1041714/united-kingdom-a...
ArangoDB Announces $27.8M Series B Investment Led by Iris Capital
CVE-2021-41773: Path traversal and file disclosure in Apache HTTP Server 2.4.49
Ah, so the author of this blog is a humanitarian
Acetylleucine – modified amino acid treats vertigo and cerebellar ataxia
I don't see excatly how the r2 model will be viable, you basically have a free CDN. I don't see that staying that way.
The official Reddit iOS app is already the result of Reddit buying an existing, excellent third-party app (Alien Blue), which they proceeded to ruin.
Wake up to the looming water crisis, WMO report warns
Gilens and Page: Average citizens have little impact on public policy (2014)
The article doesn't mention that. I think you may have misread.
Just saying "Don't write bugs" sounds a little but naive for me. I never saw someone that could achieve that task and nothing makes me believe that the author's statement might be remotely truthful.

My two cents: I can only write average software by writing tests simultaneously or right after writing the functionality. Reading the code thousands times without writing tests would just not work for me.
How do you prevent someone (or something) from accidentally draining a node hosting a database that does not have a synchronised replica?

Kubernetes is neat, but destroying stuff is so easy (and the context mechanism is just begging for human error) that I am a bit leery about hosting large amounts of stateful stuff in it.
Seems like a person could create an unbelieving cheap podcast hosting business (Simplecast, Transistor.fm, etc) on the back of R2.

For those unaware, the primary infrastructure cost of these businesses is serving up mp3.

Much like what YouTube does for video.
IMO, the best feature Cloudflare added to R2 was the automatic migration. This makes sense for a CDN to offer, but if R2 works, this makes it pretty simple to migrate.

"After specifying an existing storage bucket, R2 will serve requests for objects from the existing bucket,"

I've Beene evaluating R2, but this migration path makes it dead simple to use. I just point my code to read/write from/to R2 instead of S3, and I'll get egress fees from AWS during the migration, but then that's it?
"We can cost-effectively store the whole internet, which is estimated to be between 1 and 10 Terabytes"
The other funny thing about this whole thing, is... who gets that coin after it's printed?

We're literally giving it to China. I mean you don't create a coin without having someone to give it to.
I do not think so. I have tried to switch off relay and still it does not show AMP on Safari browser for me.
For some crimes you'd probably be able to drastically lower penalties. If there's a 100% chance a shoplifter is going to get caught when they leave the store, then just making them return the stolen goods would be enough. Harsh penalties are partly the result of an inability to apprehend people (using the fear of harsh penalties to compensate for the low chance of being caught).

It also seems likely that more surveillance will result in fewer innocent people convicted, not more. Anecdotally, every case I've read about that had video surveillance and involved innocent people were arrested, the video surveillance ended up being what exonerated them.
I am in EU and have debit and credit cards in UK and EU and business account in EU. Also because in some places only Maestro is accepted I have maestro and MasterCard debit separately…

Because of travel I also have transferwise money anywhere card.
I work at D-Wave and it has been a really exciting week for us with these announcements. It's great to see a writeup at this level of detail, we definitely appreciate Ars' coverage.

If anyone has any questions for the D-Wave team, feel free to reply here and I can see what I can do to answer your question myself or get an answer from someone else on our team.
As in, a change/feature added to the rendering/javascript engine caused an regression.
Bandwidth is very cheap [1], cloud providers gouge. Cloudflare is using this product to disrupt other cloud providers and pull business from them.

[1] https://news.ycombinator.com/item?id=28682237
Golden sun bowl discovered in prehistoric Austrian settlement
> Nothing gets better by installing Apple as a gatekeeper

Eh, privacy. A bit. The reason banks want you to use their app is they can collect more data than Apple passes along. I also doubt contactless payment would have the adoption it has among iOS users without Apple’s branding and marketing push.
That's not at all how this works.

Treasury mints the coin.

Treasury trades the coin to the Federal Reserve for existing bonds the Fed already owns.

Treasury retires the bonds which keeps the US under the statutory debt limit.

The coin isn't "spent in the economy".

It's just an exchange of assets among government departments.

Zero new money circulates in the economy.
Outside of the same authentication domain with bad auth token practices (windows) the hash almost always is useless elsewhere. Salting increases the complexity and thus size of hash tables or hash comparison (rainbow tables), but if your manage to break or brute force the entries, salted or not, the secret often is reused by many users.
Maybe? Getting a bunch of cards works out in your favor. Costco card nets me 4% back on gas everywhere and 2% in store and extends the warranty on things. Southwest card nets me miles for flying, Chase cards get me points on certain things, etc. Suddenly you have tons of cards you cycle through to max out rewards to play the game. Also spread out your credit so you don't load up a single card with a heavy purchase.
A lot of people chase sign up bonuses. Some credit cards have sign up bonuses equivalent to $1000+. So sign up for a year, and then cancel. Also our credit score systems consider number of open accounts, and anything less than 10 is considered as having too few accounts.
> It depends - These models are often non-transparent in terms of how they calculate, so what if the AI/model decides/calculate that a higher percentage of minorities in an area is a high predictor of crime, thus indirectly creates a policy that, for instance, areas with high levels of ethnic minorities require higher levels of policing or harsher restrictions (i.e. curfews, more CCTV e.t.c.).

It's pretty simple to make the models transparent. Just select the inputs you want the model to have access to. You shouldn't be feeding your model the percentage of minorities in an area.

What's not transparent is how humans make decisions. You can't tell a human to consider only these characteristics but not these others ones.

> If it's just a basic 'well murders happen between these hours on this street so we will put a police officer there' then of course that should happen, but that's not really policing based on AI/ML, it's just based on basic statistics.

I don't see how you make a meaningful separation between the two. Either you can use predictive models or not. It's hard to carve out "use predictive models but not too predictive". The more likely scenario is just not using any model and distributing police resources uniformly regardless of need.
I assume you took this down in the summer? Or you had a dog oven?
Modern Russians can differentiate between much more bluish colors, such as "sea wave", turquose, etc. I think it's the same with any people exposed to modern paints and hues so the effect is bound to be less important.

But they are not considered as separate spectral colors, whereas light blue is. So Russians have 7 colors in the rainbow.

I don't think that learning Russian will help your color perception in adult age and without being exposed to light blue paints, pyramid disks, toys, etc.

In fact, I'm not sure it will persist as much in the next generation of Russian children whose toys are usually made for world wide audience and don't set the light blue color out of myriad of hues.
Sucks for me who lives on a place where the first rays of sunlight come at 7:30ish at this point of the year, and 9:45 a few months later...
Ask HN: Are no late fees really a response to the pandemic emptying libraries?
Did you have a look at rstor.io? They have free egress and even lower storage costs and also don't seem to charge for IOPS. Not as high profile as Cloudflare though.
Kitchen Sync: smart SQL database sync without special server configuration
Or "diversification within a sector."
How big would a $1T platinum coin be?
> EU antitrust is fighting good fight

Vestager fights a popular fight, but she fights it badly. Almost everything significant she has tried to do has been blocked by courts or settled away. She’s Europe’s Eliot Spitzer.
Ginkgo Bioworks is a “colossal scam” – Scorpion Capital [pdf]
Web browsers have been trying to imitate operating systems for far too long now.
We need to get away with this current model of using a document rendering language such as HTML/CSS and a terrible language such as JavaScript to build applications that feel slower and less responsive than the slowest Windows 3.1-era applications.
Liminality
I don't know if Evergrande is the beginning, or the huge amount of Chinese local government debt[1], but I am more concerned about Variable Interest Entities [2]

So, when these Chinese firms are trading on US exchanges, they aren't trading in the actual stock, but instead, the VIE. It will only take China outlawing VIEs to wipe them out. While there is an active debate about that, there are many reasons why it would be in the Chinese interest to do so, namely, the use of VIEs as a means for Chinese expats to liberate cash from China, and, China's reduced control of company VIEs. During wartime, or as a lever, this could be fully weaponized.

Due to the VIE structure and presence on exchanges, they are much more likely to be included in ETFs. Talk about a potential for huge losses!

[1] https://www.bloomberg.com/news/articles/2021-09-29/china-hid...

[2] https://www.ubs.com/global/en/wealth-management/chief-invest...
"Mom and pop" retail investors aren't making substantial investments in SPACs without ample warning. Mom and pop are mostly in ETFs.

I don't believe anyone unaware of the risk is systematically or substantially investing in SPACs.
I've just ssh'ed a remote rpi with sdcard and logging active (Devuan stable) and it's uptime is almost 2 years. The sdcard in it probably has a year more there.
Plenty of things are possible, but just because something could happen, does not mean that it is likely.

The west is not on the brink of runaway inflation by any means. It wasn’t in the 1970s either. Hyperinflation has historically only occurred under very specific circumstances, typically after widespread devastation due to war or outright government collapse.

Edit: to add a response to the case of Venezuela, the 9% inflation rate had nothing to do with the ensuing hyperinflation. It’s not as if people’s expectations got out of control. They relied heavily on oil exports and oil production collapsed due to state mismanagement. They could’ve had 0% inflation to begin with and still would have been in this situation.
Thank you so much for this reply! Means a lot to me to get some history.
True Reasons Your Dog Is Not Responding to Your Commands
Sounds like you want someone on the left.
Plates: Unique Tablewares NFTs on Solana
https://libraryofbabel.info/bookmark.cgi?azlsfcsuzjcobmbsdow...
> The reliance on a three button mouse, which makes it impossible to use Plan 9 on a modern laptop without finagling with modifier keys (no, I don't want to go back to using a mouse, thanks).

Thinkpad ;)
Right: I mean in absolute numbers of Safari users. Even something at the #1 spot in Utilities for a few days is (in my assumption) still barely a dent.
I remember some sketchier areas on the RER between CDG and the city center.
Russian hackers haven't backed off, administration official acknowledges
I think before you get a recommendation, we should discuss what it means to be a good starter kit. I hate mealy mouthed "it depends" answers, but in this case the context seems especially relevant.

In one sense, the starter kit represents a lot of work in front of you: you still have to learn how it all fits together and works, how it might be modified and so forth.

It is likely that you will do better if you are familiar with the framework so I am surprised to hear that the language doesn't matter.

Finally, you want it to embody best practices so that when you do learn it, you can be assured you're learning about the best security, performance and other standards.

So the recommendation should be: this is the best, if you know Rails, this is the best if you know Django, and so on.

The best starter kit is almost an example app that you can copy, so the closer the example is to the final app you have in mind, the less you have to modify it off the bat and the longer you will have to learn it.
Can you elaborate?

For instance, I lived in an area where there was a lot of bike thefts. Everyone knew it and police got a lot of bike theft reports (it was in the statistics). I would like to see more police enforcement to deter bike thefts. I think its unethical to ignore the needs of a neighborhood when allocating police resources.
What an awful story, I'm sorry you had to endure that. My undergrad is in applied math and I would never even dream of calling myself a "mathematician", so, yeah, tells you a lot about the guy.
The Economic Lesson of Japan in One Chart
Perhaps, although "it was just random" is arguably an even worse explanation.