skysight-inc/HackerNews huggingface dataset:
There seems to be some confusion about this, so I'll just copy/paste what I wrote on Twitter:

>Folks, this is bad. Very, very bad. Hackers and/or malicious insiders have leaked the platform certificates of several vendors. These are used to sign system apps on Android builds, including the "android" app itself. These certs are being used to sign malicious Android apps!

>Why is that a problem? Well, it lets malicious apps opt into Android's shared user ID mechanism and run with the same highly privileged user ID as "android" - android.uid.system. Basically, they have the same authority/level of access as the Android OS process!

>Here's a short summary of [shared UID](https://blog.esper.io/android-13-deep-dive/#shared_uid_migra...), from my Android 13 deep dive.

>The post on the Android Partner Vulnerability Initiative issue tracker shared SHA256 hashes of the platform signing certificates and correctly signed malware using those certificates. Thanks to sites like VirusTotal and APKMirror, it's trivial to see who is affected...

>So, for example, this malware sample: https://virustotal.com/gui/file/b1f191b1ee463679c7c2fa7db5a2...

>scroll down to the certificate subject/issuer, and whose name do you see? The biggest Android OEM on the planet? Yeah, yikes.

>Go to APKMirror and just search for the SHA256 hash of the corresponding platform signing certificate... https://apkmirror.com/?post_type=app_release&searchtype=apk&...

>Yeah, this certificate is still being used to sign apps.

>That's just one example. [There are others at risk, too.](https://twitter.com/mszustak/status/1598406354464829440)

>In any case, Google recommends that affected parties should rotate the platform certificate, conduct an investigation into how this leak happened, and minimize the number of apps signed with the platform certificate, so that future leaks won't be as devastating.

>Okay, so what are the immediate implications/takeaways for users?

>- You can't trust that an app has been signed by the legitimate vendor/OEM if their platform certificate was leaked. Do not sideload those apps from third-party sites/outside of Google Play or trusted OEM store.

>- This may affect updates to apps that are delivered through app stores if the OEM rotates the signing key, depending on whether or not that app has a V3 signature or not. V3 signature scheme supports key rotation, older schemes do not.

>OEMs are not required to sign system apps with V3 signatures. The minimum signature scheme version for apps targeting API level 30+ on the system partition is V2. You can check the signature scheme using the apksigner tool: https://developer.android.com/studio/command-line/apksigner

>Affected OEMs can still rotate the cert used to sign their system apps that have V2 signatures and then push an OTA update to deliver the updated apps. Then they can push app updates with that new cert, but devices that haven't received OTAs won't receive those app updates.
I had the same issue on Kinoite 35 specifically, but only with GTK applications. That forced me to Silverblue at the time, but 37 seems to have ironed out whatever it was.
America's Smallest County by Area, Second-Smallest by Population
A Gilded Age Tale of Murder and Madness
I’m disappointed to see such nonsense on HN not flagged to death. Is this a troll comment that I’m too slow to get?
Given how much modern hardware is on check-for-updates-online mode by default, how long would a stolen signing key be valuable? I'd imagine the OEM would respond to the theft by cutting new keys and pushing an update to supplant the old key. There'd be some details to hammer out (retroactively declaring the old key untrustworthy past date of theft, allow-listing a bunch of software and peripherals that couldn't be updated to accept if they matched key + checksum), but it feels like stealing such keys would have a very short window of utility.

To be clear, this is not to imply resolving the theft is trivial... Some engineers will have a bad week. It's more that it's solvable from the aggrieved party's side in a way that a diamond theft isn't.
Not quite the same, but I've been working on geo-timeline views of Wikidata events.

WWII example: https://conze.pt/explore/World%20War%20II?l=en&t=link-split&...

Works of Rembrandt (by inception date and their location): https://conze.pt/explore/Rembrandt?l=en&t=link-split&i=Q5598...

Showing cultural periods is still to be worked out, but already supported somewhat: https://conze.pt/explore/Victorian%20era?l=en&t=link-split&i...
> If they’re saying that C++ can’t be saved, maybe they’re worth listening to.

It might be true, but it also sounds like an appeal to authority. I suspect there also might be voices that are being silenced or aren't given a similar platform to speak up and provide an alternative viewpoint on the matter within the same organisation, because <team budget/political reasons why>. After all, there are greenfield projects that are being started in C++20 and people are enthusiastic about their prospects. I wouldn't just blindly dismiss their reasons in favour of Google ones.
Parsing a list of list of integers, finding the maximum, in a hour, in the coding environment of your choice: this shouldn't be "under pressure".

(We do not ask in interviews questions of the same nature as the last third of AoC. If anything, most of our interview questions are below AoC day 1 in difficulty. And yet they screen absurd numbers of candidates.)
discord is easily the most common integration with Patreon, in fact it's often a strict superset of the value of being a patron (i.e. discord contains all of the content which then gets posted to patreon shortly afterwards). Discord can easily replace patreon for a lot of creators with this.
The "complexity" of a game is not very well measured by game-tree size alone. Wikipedia lists multiple factors on the game complexity page: https://en.wikipedia.org/wiki/Game_complexity#Measures_of_ga...
Testing GLOM's ability to infer wholes from ambiguous parts
It's strange to me how much effort has gone into porting things over to run on Apple Silicon while AMD GPUs seem to have been completely abandoned as an ML target. It's understandable that Apple would promote their own CPUs of course, but other than Metal they don't seem to have any interest in the GPU side, and few ML tools use Metal as a backend since Nvidia has had a dominant position in the GPU space.
How did you get "sulfate" out of "ethoxylate alcohol".

You probably confused them with ethoxysulfates, which are a related but different class of chemicals.

https://en.wikipedia.org/wiki/Ethoxylation
Is this Apple's way of taking a new stance on cryptocurrency, or reinforcing their old anti-crypto position using confusing language?

My understanding is that Apple has done all but ban wallet apps on the App Store. I thought there had been multiple attempts to do crypto wallet apps in the past from other companies, but Apple blocked their distribution on the App Store. Coinbase only gets to have as much freedom as they because they're getting the Netflix Treatment™.

If someone were to rig up a way of accepting cash, paying Apple their pound of flesh, and then converting the cash to ETH for gas fees, would Apple be more lenient?
Artemis I Day 16: Orion Successfully Completes Distant Retrograde Departure Burn
Do those work with mini split AC units? They have really odd remotes, but they’re IR. We have some Fujitsu halcyon units I would love to control over the web.
Idk - are you saying paying your cronies to do a $200,000 / week to study of trash cans is doing something, or not doing something?
They’ll get better
see how long this post lasts
https://rumble.com/v1y4u78-foot-long-blood-clots-from-mrna-s...

Idaho pathologist Dr. Ryan Cole is no stranger to controversy. His claims of horrific side effects from mRNA vaccines and his recommendations of alternative treatments for COVID-19 launched medical board investigations in multiple states, prompting the doctor to defend his license to practice medicine. 「 LINKS FROM EPISODE: https://drdrew.com/11302022 」
As the owner of Cole Diagnostics, one of the largest independent diagnostics laboratories in Idaho, Dr. Cole alleges he has seen – and photographed – shockingly large blood clots appearing since 2021. And for patients who believe they've been injured by the shots, Dr. Cole has a simple recommendation: "Sue your doctor."
Rust Foundation in 2023-25
It's on the letters the council keep sending me warning me that it's a legal requirement to register and I could be fined £80 if I don't. (I am registered, at a different address).
FCC authorizes SpaceX to deploy up to 7,500 next-gen Starlink satellites
At least some activists are saying that since the takeover, the moderation of CSAM has been dramatically improved after complaints had been falling on deaf ears for years. There are complaints that the old moderation team was ignoring clear and well-documented reports.

https://twitter.com/elizableu/status/1566255230374842369

https://twitter.com/elizableu/status/1594137408186073089

What's shocking is that apparently Twitter has had a massive CSAM problem for years and Twitter's crack moderation team apparently did very little about it, not even banning hashtags reported to them repeatedly. And none of this got attention until Musk bought Twitter.

[removed section about addition of new reporting option]

I say this as someone who is not in the slightest a Musk fan.
My understanding is that these certs are vendor-specific (and potentially more finely grained than that - I think it'd be fine to have a separate cert per model, for instance) and are rooted in the firmware, not the hardware - that is, it's not the secure boot signing key, and a new firmware update can simply use a different platform certificate.

Having said that, the fact that there appear to be multiple vendors affected by this (looking at those hashes in Virustotal, there are signatures that claim to be owned by Samsung, LG, and Mediatek, at least), and that's certainly concerning. My entirely unsupported guess is that they may all share manufacturing for some models, and certificates may have been on site there?

But the more significant question is how many phones trust these certificates. As I mentioned before, these could be model specific, and any leaked certificates could be tied to a very small number of phones. Or maybe Samsung used the same platform cert for all phones manufactured in the past decade, and that would be a much larger problem. With the information presently available we simply don't know how big a deal this is.

Edit to add: given Mediatek certs appear here, and given all the vendors linked to this have shipped low-end phones based on Mediatek SoCs, it wouldn't surprise me if it turns out Mediatek were the source.
The existence of leaked platform signing certificates breaks a core Android security feature: the application sandbox. Theoretically, a malicious actor with the leaked cert can sign an app and declare the shared user ID Manifest element to run in the same process as 'android', ie. the operating system process.
What about Dell for the raft of overheating 9550 XPS's with broken hinge posts?
I write a lot of Rust these days and unfortunately really great FP stuff is pretty damn cumbersome to write.
I have Macbook Air M1, which is passively cooled. When cooled properly, that is thermal pad mod combined with a fan under the laptop, I'm getting closer to 2min - something like 2.8s per iteration. I guess it would be something 140s for 50 iterations on a MacBook Pro or Mac mini for M1.
I am a user of brave search actually, I’m glad you guys released the product!

Really more than anything else, I think about how important search is to the open web/maintaining a healthy internet. And by that, I mean that I don’t think having one dominant search provider is a good thing.

There are a lot of small upstarts that I’m happy to use such as brave/ddg/etc, but given the fact that many of those use bing as a backend I am left wondering how viable they’ll be in unseating google/bing (I know brave maintains its own index, which is a big plus).
Updating it doesn't make this kind of problem away, unless they figure out a way to have real time updates to the model (could happen)
> As radio transmitting devices you will never be allowed to control them.

There are actually two parts in a smartphone: the baseband/radio processor and the app processor. They are both complete systems, with their own CPU and software, sometimes, each have their own chip. The baseband controls the radio as well as a few other devices, it runs proprietary code, usually an encrypted, signed blob. It is only accessible through a well defined interface and doesn't run arbitrary code. This is the part you can't control.

The app processor is the thing that runs your main OS (ex: Android) and all your apps. It can run arbitrary code and that's the "computer", the part you can control.

In a traditional PC, the baseband could take the form of a PCIe card, and in fact, it is often exactly that. For example, a lot of laptops have a separate WiFi module slotted into the main board.
You know twitter requires a phone number now right? I don't have a Twitter account because I don't use twitter. Why do you assume a a closed off platform so accessible to everyone?
The Apple Neural Engine in the m1 is supposed to be able to perform 11 tops. The GTX 1080 about 9-11 tflops.

So sounds plausible that the m1 can reach the same level in some use cases with the right optimizations.
While searching for causes, did you also look at ways to strengthen/rebalance/improve your GI system?

I'm not sure if this will turn out to be quackery or snake oil, but the Super Gut book by William Davis makes some believable claims as to common causes of digest issues (along with solutions).
You can play Zork with an interpreter written in postscript.

http://zzo38computer.org/zmachine/interp/zmachine.ps

http://microheaven.com/ozmoo/games/calypso/calypso.z3

gs -- zmachine.ps calypso.z3
That's a fancy wikipedia chatbot. Nothing to do with generalisation.
Oh totally get it. Staten Island isn’t a rat paradise either… but the density of people is much lower.
Energy Management: Manage Resources, Not Time
Great, let me know if you have any feedback!
I tried to read this 3x. He lost me after 2-3 pages of describing what it’s like to wake up suddenly.

I guess because the book is famous you’re supposed to slog through boring starts but I couldn’t do it.

I had the same problem trying to get through the first 10% of War and Peace. Seemingly dozens of characters standing around at a dinner party with no discernible plot.
Where did I say we would or could decide against it collectively? Individual people can decide for themselves not to engage with harmful technologies in the future, just as many do today with cell phones, computers, television, etc. Not everything has to be done by governments.
Location: Southern Alberta

Remote: Preferred

Willing to relocate: Yes

Technologies: Experienced QA professional, particularly in GLP/GMP/GPP. QMS / quality process design, implementation and streamlining. Spreadsheet, software and instrument validation / 21CFRpart11 and OECD compliance. Elm/Haskell and .net in service of the above.

Website: https://hylandqs.ca

Linkedin: www.linkedin.com/in/brendan-hyland-b23bb04

email: brendan at hylandqs dot ca

Resume: Available on request.

My name is Brendan. I'm an experienced GLP/GMP/GPP QA professional with a bit of a programming problem.

I help regulated pharma and cannabis facilities with quality, compliance, validation and in particular streamlining those processes.

I closed out a couple of successful multi-year projects this year and am now re-emerging into the market, trying to figure out what's next.

I have hands-on experience in a Cannabis/CBD extraction facility as well as pre-clinical Pharma. I'm a Health-Canada approved QAP with security clearance, and a Registered Quality Assurance Professional. I have managed large multinational drug development projects and small QA teams.

I can also program, and have built and delivered custom software and a few full stack web-facing projects. Preferred technologies these days are Elm & Haskell, but I spent a few years tied to the .Net ecosystem. So if you need someone to bridge the gap between your software engineers and the lab bench, production line or regulatory department, I'm your guy.

Feel free to drop me a line even if it's just to chat, I'd love to hear from you!
The beauty of stealing a signing key is you don't necessarily tip off the company by getting yourself a copy of it. (The diamonds were removed, but the key stays where it is)

If you were clever enough to get the key you might hold it until it was truly valuable for your exploit.
> The plastic itself (PTFE) isn’t the problem, it’s the additives

Yes and what additives are being added to the PTFE in your non stick pan now? Do you know? Are they proven safe or merely not banned yet?
I had star wars stratego that i played where they reversed the number values. It was characters from the OG trilogy and episode 1. takes me back! $80 on amazon for that version :(
>Leaves little time for Android devices to get the new key no?

It's not so simple, also rotating the keys could affect how devices get app updates, depending on whether or not an app has a V3 signature or not. V3 signature scheme supports key rotation, older schemes do not. OEMs are not required to sign system apps with V3 signatures. The minimum signature scheme version for apps targeting API level 30+ on the system partition is V2.

Affected OEMs can still rotate the cert used to sign their system apps that have V2 signatures and then push an OTA update to deliver the updated apps. Then they can push app updates with that new cert, but devices that haven't received OTAs won't receive those app updates.
Ribbon | Remote or On-Site | Toronto, Canada | Full Time

http://ribbon.cool/careers

Ribbon is rebuilding the world of professional social networks and employee recognition to be centred on one thing: ownership. We believe that everything you accomplish and achieve should be recognized and owned by you (not by a third party). When you move between organizations, your achievements and benefits should move with you.

We’re backed by top tier investors and operators from across the globe (to be announced soon - we're currently semi-stealth).

We’re hiring full stack developers for our founding team - join us!

More info here: http://ribbon.cool/careers
To apply email arsham[at]ribbon[dot]cool
I think he bought in more people at one point, then sent them away again when he realized he wasn't able to keep the project on track with that many chefs making the soup. The problem with more people is that the project can very easily degenerate into design by committee.
> so we may not be speaking the same dialect.

To be fair, I was pilfering loanwords like "screen-space"(adj) from the 3D dialect.

> In order to simulate a camera looking into a 3D world, I need to draw everything from the top of the screen to the bottom

Right, the point I was trying to make was that, technically, you need to draw things from the north edge of the world to the south. If you have a asset with height, you need to draw it at a higher screen position, but also a later time, than a low/short asset that's at norther world position but lower screen position. (Presumably you know that already; I was mostly asking/objecting about confusing the screen position versus the world position.)

> I can add the asset's world height multiplied by asset's (rectangle) height to the screen.y position (again, just for the depth sorting part)

My point was that you'd add[0] the world height plus the world.y position, in order to get the screen.y, but depth sort based only on world.y, independently of height or screen position. That way things that are vertically on top of each other have the same world x and y coordinates (differing only in z), even though they're draw at different screen.y coordinates to provide isometric simulation of height.

0: give or take factors of -1 depending on which way the various coordinate axes go
If you stole a hardware key (which I am speaking of), you've just smashed Secure Boot on all the devices that use it, forever. You can boot whatever software you want on your PlayStation, or Xbox, or Windows Secure-Boot-Enabled PC, or iPad, or similar. Every device with that key has had their locks smashed and there's no going back. Once you've done that, downgrading firmware, modifying firmware, undoing software updates, it all becomes a lot easier.

Bonus points if you stole a Windows signing key and a Windows Update CDN Certificate. Send out fake Windows updates, approved by Microsoft, to do whatever you want. Maybe even force them to use your own middleman update server and only recognize your own keys. Fun stuff.

Got the Apple signing key? Revoke any app you like and have it instantly lock out from millions of iPhones. Break every app for everybody on iPhone and give Apple employees and users a miserable week and cause a political panic. Sky's the limit.
This doesn't make sense because we can buy and sell crypto from Coinbase, Uphold, even Cash app right from our phones. We buy crypto and send crypto, and that has its own fees associated with it. Why does apple allow any app that support buying and selling crypto?
The public evidence doesn't seem to suggest that any Google-owned keys are affected. Platform certificates are owned by the vendor.
What’s the logic?

It's the law. The law uses a formula.
Too bad that likely isn't possible. Our brains require physical continuity, upload without physical integration is not possible
Um what?

So me and my buddy Tim are going to come to your house and talk about how much you suck.

Autoexec: But this is MY private property.

So yes, So are online platforms. They can kick you out at any time they want and you can pound sand. If you don't like it set up own server online to freely associate. You don't get to demand their resources. You don't get access to their network.
> that structure would be such a transparent attempt by the game developers to evade Apple’s fee.

That’s the core of this of course. It’s not the scheme, or how many intermediary there is, or wether entities are separate or not.

It’s about money flowing on the platform that Apple doesn’t get a cut of. Some cases have been grandfathered in at the start of the App Store (mainly physical goods and traditional banking) because there was no way for them to tax that at that time.

I trust Apple to fight tooth and nails to not let any additional money flow escape their tax, whatever it is.
Quick and dirty: OTs require a centralized controller and a (potentially complicated) merge strategy to shepherd conflicting changes. CRDTs on the other hand apply commutative operations so they don't need be centralized, though nodes that communicate infrequently might get very out of sync
I immediately liked the way you described the snake-oil. Bravo!
Fond days while studying, network protocols class. Such a great tool, easy to use and full featured.
All online platforms need to have moderators to prevent things like spam and illegal content. That doesn't mean that they can't also uphold the idea of free speech principles though.

Musk really went crazy with cutting staff, but I'm not sure if it was because he wrongly thought he needed to cut the moderation teams in order to support free speech or if he just did it because moderation is expensive.
These platform certificates are all from different vendors, but the problem is that one of the leaked certs appears to be from the biggest Android vendor...Samsung. And that cert is seemingly still being used by them to sign apps.
Show HN: Recipe software for saving and searching recipes
Made a LAN web-based recipe software with a database back-end that lets you save, search, and make meal plans with your recipes! Any suggestions are very welcome. I'm an independent publisher, posting this software. Right now my pricing model is to have a 2 week free trial before it asks for a serial code, which costs $7.
Drew Devault to write less due to his experiences with internet toxicity