skysight-inc/HackerNews huggingface dataset:
They already have, most AV software nowadays is adware. If you are lucky they'll just slurp your data and maybe get you to install Chrome or some other random piece of software but some are even using your PC to mine cryptocurrency nowadays.
Labor force participation rate is still below pre-pandemic levels.
This is implemented in Nautilus, Dolphin, and Pantheon Files. Not sure what you are talking about.
https://nitter.kavin.rocks/nexta_tv/status/15005534805488926...
It would be awesome if you reviewed the blog post's (https://0ut3r.space/2022/03/06/windows-defender/) recommendations for accuracy/meaningfulness/etc.
There's a bit about Yubikey at the very end of the article.
https://nitter.kavin.rocks/AchieAd1974/status/15005555132470...
CSGO and Dota players popping champagnes
I get what you are saying, but I don't like the way you are conflating personal use of these vehicles with commercial use.

Some people have a good reason to own heavier vehicles for private use, but even in a rural setting, those are few and far between. There are many more good reasons to own such vehicles for a trades person or a farmer. Commercial use of those vehicles is completely justified.

Maybe it is an American thing I don't get, but there seems to be a confusion between private lives and the work people are doing? Someone does have to cart the tools and materials to the worksite, but that person should be using a work vehicle. There doesn't seem to be a need for that person to own their own truck and pay for their own gas?
Windows Defender doesn't have heuristics/behaviour based detection.

For example, if you write a simple keylogger using the Windows API in C++/Python/..., compile it and run it, an antivirus like BitDefender will block it by default. It's up to you then to allow it or not.

So it can sometimes detect and block unknown malware, a thing that Windows Defender can't. So for some people it might make sense to have a more "strict" antivirus.
> "If you want to shoot a gun, you need to get a permit."

> Not in the US,

This statement seems to lack nuance and could be the reason for the downvotes.

> Federal law does not require individuals to obtain a license or permit to purchase a firearm. Several states, however, have permit-to-purchase laws that function similarly to universal background check laws.

https://www.rand.org/research/gun-policy/analysis/license-to...
I was involved with WSGI back when this was being decided... it was definitely a known problem, but a particularly good solution never revealed itself. The CGI variables it was based on had decoded semantics so it couldn't be redefined in place, we'd need some other names. Some gateways might have already decoded so recreating an accurate original URL might be hard in some deployments. There's another common key that includes the unencoded complete URL but WSGI had a split URL representing previous URL-prefix based dispatching (which came from CGI) and so there was some ambiguity there if you tried to make use of it. Two variables representing the same thing is a recipe for confusion and possible security problems, even worse when the two things have such subtly different quoting semantics. So it never really got fixed.

Something like this is there to solve not just errors because of gateways doing decoding, but also browsers and email clients and everything else that might break a URL.
In the context of Haskell "ad-hoc" means ad-hoc polymorphism.

See https://wiki.haskell.org/Polymorphism for details on parametric (ie. unconstrained) vs. ad-hoc (ie. constrained) polymorphism. In short the difference is that ad-hoc is parametric + one or more type class constraints. Eg. in:

λ> :t fmap
fmap :: Functor f => (a -> b) -> f a -> f b

the type variables a and b are unconstrained while f is constrained by the Functor type class.
Indeed, I guess if you've got a Union Pay card, or whatever it's called.
The inability to simply "see client data" even if you go through multiple bastions did kind of surprise me. I worked at several startups before Microsoft where just asking the client for permission was considered OK.

This certainly makes debugging production issues much much much harder - there are certain environments whose data you simply can't access (either as a user or as an administrator) and you have to rely on telemetry (much of which you can't gather since it can possibly be used for PII - this is all an audited process) to debug issues (attaching a debugger is also prohibited since you can read data that way and the port is closed).

Instead of trusting me - think of the corporate incentive to do well here. Consider how much it would cost a company like Microsoft if employees were exposed to confidential customer data (our customers can work with medical data, so a fairly expensive legal nightmare) vs. what the company gains (engineers have a slightly easier time debugging). At Microsoft scale I guess it simply makes sense to be super strict about this.
A structure is a monad if you can nest one of itself inside another without a visible seam.

If you have a binary tree whose leaves are also binary trees, is that meaningfully different from a single grafted binary tree? Not really.

If you have a sequence (list) of sequences, is that meaningfully different from having a single sequence? Not really.

If you have an option of option of bool, is that meaningfully different from having a single optional? Not really.

More precisely, if you don't care about the difference, structures that are monads let you smooth over the seam between nesting levels.

The flatMap operator lets you extend a data structure at each of its leaves. That is, you can map over each leaf and replace it with another structure of the same kind, then smooth over the seam.

The connection with computation comes about by imagining the data structure as the history of outputs of a process; a trace. You can extend a program trace by specifying what to do next (via flatMap). Clever choices of data structure give you interesting alternative models of computation. But, this is an application of modeling with monads. It's not what a monad is.
>CrowdStrike Falcon

for the first time, i have a machine with this installed and holy damn... it's so bad. it uses 30~50% cpu all the time + tons of IO. how can people just accept software that just degrades your machine for small gains on security?
"It is almost superfluous to remark that a democratic Government always shows worst where other Governments generally show best, on its outside; that unreasonable people are much more noisy than the reasonable; that the froth and scum are the part of a violently fermenting liquid that meets the eyes, but are not its body and substance."

— John Stuart Mill, The Contest in America, 1861
The naming and, from what I've gathered, recent changes are a mess.

Recently I looked at M365 business premium and thought that would only include Defender for O365 (why not M365?) and require a separate subscription for Defender for Endpoint, but now it looks like Defender for Business is included.
So how can the people who are targeted - mostly minorities - use “Democracy” when the majority either doesn’t care about the mistreatment of minorities or even cheerlead it? Not to mention that politicians are afraid of blowback from police unions and the majority who support them since people don’t get stopped for “driving while White”.
Really well said. Is there a term or concept in the AI literature++ that captures this point/conjecture?
American's addiction to large, gaz guzzling status vehicles is part of the discussion
Some H7 parts are rated up to 550 MHz, and they'll overclock well beyond that.
For all the governmental entities owning a public resource on Internet

- remove all the JS code loaded from outside sources

- move all the resources to hosting physically located in Russia

- move all the resources to zone .ru
God forbid people suffer the consequences of their vehicle purchasing decisions.
The original post I was responding to was saying it was already game over regardless of whether hacker had the ability to sign their binary.

Clearly that isn’t true.
The issue here is the experience level of the devs. These sorts of conversations should have people declare their years of programming experience at a minimum, it helps to understand perspectives better.
It’s true the west does not want to get their hands dirty, and the people of Ukraine suffer all the more because of it.

The reason is Nuclear Weapons. Putin is holding the world hostage and saying “don’t get involved or I blow us all to hell.”

The blame is on Putin. He invaded. He cried the crocodile tears about NATO while approving unjustified war on the people of Ukraine.
The source of this article seems kind of dodgy.

- I haven't found a credible source corroborating the claim made in this article.

- Their FB page has surprisingly little traffic for a news site and their twitter account was suspended recently.

https://www.facebook.com/then24dotcom/
https://twitter.com/then24dotcom

- Their contact email is...not one you would expect for a legitimate news site (celebsbabe @ $major_mail_provider).

Edit: formatting
Bring it back? You act as if minorities are still not routinely stopped and harassed more than non minorities.
I downvoted you, here’s why:

I think it’s clear the author isn’t proposing that people should be licensed to use the internet. It’s at most an aside, and not the topic of the article.

The observation that one of his analogies doesn’t apply in one country (pretty sure not the one the author lives in) doesn’t really contribute anything IMO, and certainly we won’t change anyone’s mind about US gun law by another comment thread. I’d rather just not open that box.
It's downright perverse to insist that you should be able to assume all accesses are volatile reads/ stores just because that was momentarily convenient.

C lacks the intrinsics you'd actually want for this (explicit load/ store of various machine sizes) but it does provide the "volatile" storage qualifier which is what you should be using to do what you apparently wanted in C today. It makes no sense to demand everybody else writes some sort of "not-volatile" qualifier in front of every variable to tell the compiler that actually this is just a variable and it's OK to optimise.
How big is your lawnmower? Mine fits in the boot of my car.
(I was PM for a product that piloted just around $100k and that had a median full phase 1 deployment price in the 7 figures, and this was back in the early 2000s).

Real enterprise sales are much more relationshippy and less transactional --- just in my experience --- than this post talks about. Making these sales is a lot about taking and managing meetings, understanding RFP processes, structuring bakeoffs and trial deployments, and, probably most importantly, staffing sales prospects with SEs to handhold the deployment and keep the relationship with the technical decision-markers warm. Knowing who the economic buyer is, and who the real decision-maker is, is another important skill not mentioned here.

Patrick isn't really talking about enterprise sales; he's talking about how to hack the reflexes of enterprise purchasers to bootstrap a self-service product. Serious enterprise deals often take multiple quarters to close, and they can be staffed almost the whole time; it's a whole big thing.

None of this should be construed as me knocking the post. The post is fantastic for what it's actually about.
Gathering 15 comments within 15 minutes is very rare on Hackernews. 12 of the 15 comments are from accounts created today. Have people from the mentioned IT communities been asked to come to this page and to create accounts?
I'm absolutely horrified at what the "modern web" has become. More complexity, more bugs, more barriers to entry for anyone else wanting to write their own browser and have it be usable for most sites. Google seems determined to squeeze everyone else out with this feature-churn.
I don't think it's really a nitpick to point out factual inaccuracy. That happens all the time on here and is a feature of an audience committed to truth.

As a secondary point, do you think the author's use of licensing examples was on-topic? I don't see them go into any detail licensing, and it has little to nothing to do with the topic of hardening Defender.

That said, yes, I do see that my initial comment was lacking the context later added in the edit.
>They are not going to kill most of their own people

What makes you think that? Do you think the Uyghurs of which there are millions in China should just walk out shaking their fucking keys?

If Putin loses the war he will lose power. He will no longer win the next election as he'll be seen as weak. So he can't change his mind and if people start a protest in Moscow it is in his interest to do everything he can to quell it.

Furthermore you say you have no sympathy for Russians if they can't manage to get a million people to walk out. So if there are only 10,000 people who are against Putin, they just have to suffer the consequences for the choices that the rest of them made?
So the hackers have actually just secured all of Nvidia's and Samsung's private information, out in public?
Russia's War Prompts a Pitch for 'Socially Responsible' Military Stocks
Not sure what you mean by "trying the saas way of things". We still sell Arq 7 as a standalone app. It comes with a year of updates. You can choose to renew, or not and keep using the app you bought forever. Similar licensing to Panic's Nova app https://www.arqbackup.com/documentation/arq7/English.lproj/a...
I've seen a case when someone implemented an algorithm after an existing AI was created. I can't remember unfortunately, but the hand made version was better so it's certainly a possibility. NN-s automate human problem solving as it was demonstrated recently by DeepMind's AlphaCode.

It can be quite practical though as we failed to come up with solutions that were previously out of reach before deep neural networks (and massive increases in hardware capabilities).
One big difference is the suddenness of the downturn and the contrast to previous life.

Up until now, Russians were reasonably well-off and reasonably free in their travels or political views, if they kept those to themselves.

Unlike North Koreans, they'll have memories of a better life, adding discontent to their fear.

Whether that will make a difference in practical terms is anyone's guess.
The “electorate” made up of the majority has never been sufficiently “outraged” by the conduct of police with respect to minorities.
All five recommended languages are functional languages very similar to each other. Why not recommend a language outside the functional paradigm, such as a logic programming language (Prolog, ASP, Mercury, etc), or, I don't know, an esoteric language like Brainfuck or Modrian? We're trying to teach programmers to think outside the box, correct?
Anytime an article on technology begins with an appeal to authority, then lists authorities who hate the technology, while citing zero authorities who are proponents of the technology, while also admitting that it is a contentious subject with advocates from both sides - it is not a balanced article. It is a hit piece.

The amount of misinformation in this piece is frankly incredible. I have seen credible anti-Bitcoin content on HN in the past. This is not credible. It is barely coherent.

For example, check out the authors claims about decentralization, the ease of 51% attacks, and forks - then ask yourself why in 12 years no one has successfully attacked the network using one of these seemingly easy to execute exploits.

Bitcoin offers an almost $1 trillion USD bounty for anyone who successfully attacks it, open for any hacker with internet access. Can the author or the authorities he cites explain why the network remains I hacked?

We can do much better on HN.
You can replace a chunk of innerHTML faster than a full page reload, using a near-trivial piece of vanilla JS.

But a full page reload also clears out memory "leaks", old state accidentally kept around in caches, clinging to DOM nodes discarded long ago, but themselves still referenced by an old copy of a data structure, etc. If you go for a SPA, or even something in between, suddenly being careful about your data structures becomes a major concern to long-term app use, carrying a whole new category of debugging.
Word. Silent data farming is certainly worth more in the long run than ransomware encrypting the whole disk of some John Doe.
It has been my experience while fixing family members computers that unless you uninstall the third-party antivirus software Windows Defender doesn't kick in. If I recall correctly there was an instance where I tried to switch from third-party to Defender (without uninstalling 3rd party) it would not let me stating that AV was managed by group policy (? I forget the exact phrasing) and I had to uninstall the other antivirus software first.
One way to make college more impactful for all students is to engage them in learning the entrepreneurial skillset.

Can you define "entrepreneurial skillset"?

What makes you think that college professors have these skills?

Catch-22: College professors lack entrepreneurial skills. People with entrepreneurial skills lack the qualifications to be college professors.

Suggestion: Stop trying to shoehorn everything into a "traditional college education".

Entrepreneurial skills would be a perfect topic for on-line classes and a certificate program. Someone with "entrepreneurial skills" should look at starting this up.
Not just from a vulnerability poerspective but also a dev and testing perspective. Constant updates makes testing far more involved for every release since you can't just focus on the parts the dev work would have affected, you also need to thoroughly test everything that was calling into the updated dependency. But if you don't update enough, once you really do need to update either for security or feature reasons, you may have a nightmarish process ahead of you of dealing with breaking changes and transitive dependency incompatibilities.
Same with phone notifications.

You enable notifications from Uber/UberEats/whatever because it's useful to get notifications like "the driver is on the way", "the driver is here". But then they also send you spam notifications.

And at least on iPhone, I don't know of a fast way to toggle notifications for a given app. Endless-scrolling the list of all apps in the notifications config menu is annoying enough to where I never bother.

My carrier (Telcel MX) does this too. They send important messages about my subscription on the same channel they spam me with offers. They even send me warnings about phishing attacks from fake Telcel ads. Well, maybe people wouldn't be so susceptible to it if you didn't train them to get used to ad spam.
That is a good question, maybe they had only heard it spoken, so they thought it was 83 86 instead of 8086,80386 etc.
I think you're overestimating how many people grew up in a neighborhood where that story was reproducible.
The trick with speeding up rubocop (and most other linters, for that matter) is to run it as a daemon. There's a rubocop daemon gem available. Or with solargraph, rubocop is kept in memory so you only pay the startup cost once. With that setup you can get a lint/fix on save in sub 300ms.
OP is going to have a heart attack when they install ghostery.
That's why the standard recommendation is to generate keys on an airgapped computer without persistent storage, and run keytocard from there.

I have a set of dead Yubikey 4s that are blacklisted from GitHub because the onboard key generation code generated insecure keys (nevermind that I didn't use that feature, but wygd).
I maintain configs for both to do just that!

https://gitlab.com/divested/brace/-/blob/master/brace/etc/ch...

https://gitlab.com/divested/brace/-/tree/master/brace/usr/li...
Saying that people that don't need trucks shouldn't buy them is not attacking anyone. Stop seeing things that aren't there.
Interesting. I had not heard of restic, yet. My default backup choice has been borg[1] for a long time, so borgbase.com was a natural choice for off-site backups for me. They make Vorta a decent GUI client for borg - that's how I found out about them.

Can someone here give a comparison of borg and restic by any chance?

[1]: https://www.borgbackup.org/
According to this article, modern 1/2 ton pickups (why not 1 ton?) weigh 1/12th, are significantly narrower and shorter. The only metric by which they are about as large is length. And that is clearly nothing new either, plenty trucks and cars from the last 100 years were 20ft long.

This is like saying modern bicycles have gotten as large as WWI airplanes by comparing wheel size.

Thppt...
Really? That's interesting. We deployed this a few months ago this where I work and haven't encountered any performance issues like this. But we have had the fun of encountering BSODs when some of our end users try to use Excel.
The Russians are using the old "Saddam Hussein has WMDs" meme. Just replace Saddam with Zelenski and throw in the "fighting facsism" theme to reuse some Cold War propaganda that the Soviets were brainwashing everyone East of the Iron Curtain with.
That's correct, but it's a totally different argument.
of course not. why would Taiwan give up its leverage like that, they dragged their feet on the AZ plant too.
Not the opinion of my employer but: no.

A state level attacker can likely acquire 0-day exploits that are not patched and bypass defenses.

Microsoft's offering does some really cool stuff like:

- Automatically detecting anomalous behavior in the network and isolating suspected devices/ips/machines/programs.

- Have real time security engineers constantly monitoring your network and hunting attackers and suspicious activity.

- Tools that automatically isolate possible attackers and help measure the impact of attacks.

> Can we trust Microsoft to be neutral and offer security patches in a timely manner

Yes, that for sure. Once an exploit is discovered it is typically very quickly identified. A lot of the times security patches don't come from Microsoft though - if you consider something like Log4Shell (the Log4J vulnerability) for example.

> defend the interests of their consumer customers above all?

I'm... not sure about "above all" since I am not sure what "all" is but if the implication is that Microsoft won't patch a security flaw for a state level APT then "yes". At least - if it ever happened it happened _way_ above my pay grade and if employees would learn of it there would be outrage.

> With the whole conflict in Europe, the issue of state level adversaries is raring its head again.

I think state level actors have consistently been a problem.

Note again as already mentioned none of this represents the opinion of my employer, just my thoughts.
>Instead of trusting me - think of the corporate incentive to do well here.

Unfortunately, when it comes to anything Microsoft related, due diligence research and logical thinking is rarely employed by the HN crowd, and instead replaced with anger and FUD. I've lost count of the amount of comments saying Microsoft is forcing TPM to spy on us.

Not saying that the alphabet agencies or nation states couldn't misuse Microsoft's reach to get more private customer data, but that would apply to all US based corporations, not just Microsoft. And since AFAIK, Microsoft seems to never have been hacked for its customers' data to be leaked like it happened to Sony and Facebook, it seems they're doing a good job so far of keeping the amateur bad actors out and their customers safe.

So thanks for commenting and sharing inside infos, as some big companies ban their employees from doing the same.
I guess I'm hoping it'll mean people drive less
> Most manufactures decided to include Microsoft's signing key into firmware. That is not something Microsoft is in control of.

AFAIK if a manufacturer wants to sell Windows PC, it has to support secure boot.