skysight-inc/HackerNews huggingface dataset:
There were (or are?) some older call of duty games being sold on steam that had unpatched RCE vulnerabilities in them. Simply joining a server ran by a malicious host can result in the players system being totally compromised.

These games would go on sale once a year or whatever and attract new players, and people would post warnings in the steam forums and whatnot to try to stop people from being effected by the issue, but I am sure some people either didn't listen or didn't notice the warnings.

I haven't looked into the issue in a few years at this point, but it's very possible that the games are still unpatched and being listed in the store to this day.

Anything that connects to the internet needs to be strongly concerned about security!
I've been interested in them since the early days of Atom, but it's just taken a while for me to develop as an engineer and build a system around the theory that puts them to practical use.
Twitter is not a common carrier, and has significant differences from phone companies.
You're not evaluating laptops holistically. You can always find something that is lighter, runs faster,or has a longer battery, but right now it's tough to find any laptop that can compete with the current crop of MacBooks in all these metrics at once. The only place Apple really falls behind some of the competition is repairability.
The bug doesn't mention any vendor, rather the bug specifies "Partner-Multiple", seen reports elsewhere that points to a particular vendor?
Hey wtf, you told me that the dishwasher didn't get all the dirt off, but it was OK, the heat sterilized it! Damnit Bob!
Correct, but there are likely applications of AI in strategic reasoning that are used in the real world (outside the obvious finance bots) by engineering a "translation layer" from real world constraints to AI-compatible value functions and back.

But in general, yes, this is why since 2013 we don't see AI making anywhere as massive strides everywhere as they do in boxed-in applications like games.
Unless it's completely random, you're just giving away information. i.e. do the opposite of their body language, only exhibits body language when it's really bad or really good, voluntary vs involuntary body language.

You only use the "tell" when you believe there to be a pattern.

Otherwise, if it is truly random, I realize I can't get any info there and I ignore it, which then leads to me just having a straight face.
The alternative is well-funded and well-connected institutions like the Cato Institute and other think-tanks being treated as authorities that the media and government can launder "the truth" through, and anonymous Internet commenters proving them wrong being censored.
This is why they make backup HSMs.
> what makes you think they’re going to pressures by some crypto geeks?

They wouldn't be the ones being pressured. Instead it would be lawmakers.

The EU has already passed a law, and the USA is considering one, that has already passed out of committee.

Governments can just start confiscating Apple's funds. What, is there going to be an Apple private military, that invades bank of America, and forces them at gone point to not follow a court order? Yeah no. The courts will order them to pay money, and the banks will send the money, no matter what Apple thinks.

The Fines in EU would be something like 10% of global revenue. They can't ignore that.
This is a well know, and I'd imagine well used technique

see https://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis
Camera turns your photos into frames from a movie
Posting online consists of an individual speaking and a platform publishing it.
Social media is not a passive medium like a telephone; it acts as an editor, albeit algorithmically.

In my opinion, the fact that speech online has this dual nature is why there is so much debate about it. Here's a mock interaction...

Individual: "You shadowbanned me. Why?"

Platform: "We don't want to publish you 1 billion times on the internet"

Individual: "Then don't be an editor. Don't give people special treatment."

Platform: "We tried that at first; it did not go well. I can make my platform however I want to."

Individual: "But there are only handful of people making choices that affect billions."

Platform: "The vast majority of these people are not banned or censored"

Etc etc, the debate never ends, because the two sides have opposing financial interests and political opinions/values.
Network companies like Cisco sell high end network devices that do ULL (ultra low latency) for use cases like HFT
There is a new player in the professional poker scene that people call "Casino Eric". He combines reverse tells with insults and jabs at the opponent. This helps him make up for a lack of pure technical skills when compared to top online players like Linus Love. This is a meta game that people have played for a long time, but "Casino Eric" is known in professional circles as someone who is naturally trying to perfect this.
Freedom of speech exists in dozen of countries but "Free Speech (TM)" is a very US specific thing that seemingly generate an infinite amount of non-sense. People get lost in abstraction and start to think that giving a megaphone to fascists like Twitter did even before Musk is somehow good because the best way to defeat fascism, when you live on planet Mars, is on the "marketplace of ideas". On planet Earth this is not at all how it works, the rise of fascists correlates directly with diminishing freedoms, and to defeat fascists you need the Red Army.
Gonzalez vs. Google – Brief of Reynaldo Gonzalez et al. [pdf]
> I wouldn't expect a company like Brave to do the same, though.

Companies change. When the leadership/guard at a company changes, or with enough investor pressure, policies can easily change from benevolent to a money grab.
.NET open source is 'heavily under-funded', says AWS
I know that at least some of those companies use HSMs. Multiple, actually.
> It's not like you can pay $3 to Google to get them to stop surveilling you.

You can, at least for Youtube - the premium offering is ad-free. In fact, that's the only reason I subscribe - not the content - because my entire family uses my account or is part of my Google "family" to bypass YT ads. Worth the (ever increasing) monthly fee.

My guess is that this only exists to foil Netflix, and if Netflix didn't have an ad-free service, Google would make this option cost a lot more or remove it entirely.
Oh, I was thinking of animal fat in general. They have some minor genetic adaptations to get more vitamin D from it (since there's not much sunlight) and after moving away from the traditional high-fat diets now lack it as much as anyone else.
I agree that a pool of equal peers is tough these days. I think the Fediverse has a pretty good approach, where most end users are on mobile but you can spin up a server whenever.

There’s still a big complexity/skill/cost jump from “I toot from my iPhone” to “I run a mastodon instance for my company” though. Some of that can be addressed by managed hosting. It’s probably preferable to have a “super peer” though. In my mind, a superpeer runs the same software as a peer, but does more work because it can. It should be easier to maintain than a full server. I’m taking about the difference between:

A) manage a mastodon node, with its own redis, PostgreSQL, web server, object storage, etc

And

B) run BitTorrent in the background on your gaming PC to seed the latest cut of the niche documentary you’re working on

There’s a lot of interesting self-hosting projects happening, but they tend to focus on helping you run kubernetes or a similar container orchestrator. That’s still way more complex than an executable.

I think we need things to get a bit more opinionated again…
Then it seems that sexual selection selects for weaker sperm?

That sounds like a contradiction
Where there's a surprise on every plate.
Is there a way without (much) extra HW? Like via the DIN serial port to a PC or something?
" ... cutting new keys and pushing an update to supplant the old key ..."

What about the keys to say Windows updates?

If someone manages to nick the key you can be sure that they would push a new one and revoke the "old" one whilst simultaneously deploying nasties.

100M (whatevs) is chicken feed compared to the rewards from compromising something like Windows updates. Bear in mind that a simple pecuniary minded criminal gang might leverage a lot of coin mining or whatever for a while and generate an awful lot of electricity usage but a state level actor gets the real crown jewels: information.

Anyway, that's far too complicated when there are far easier ways to crack rather a lot of the world. Look at the Solarwinds compromise. That sort of thing won't (and wasn't) be the last.

Supply chain attacks in the IT world are probably the worst in terms of fall out and the potential losses are vast in comparison to a bit of shiny carbon falling down the back of a sofa. However, for some reason, in this most bizarre modern world we find ourselves in, we still fixate on a bloody diamond!
> Is there no channel to re-key Secure Boot from an online source?

There is no such method. Any such method would be potentially vulnerable if the device was jailbroken (from a purely software hack) - in which case, you would need some sort of permanent key to verify the re-keying which defeats the point. As a result, the Secure Boot key is burned into the chip and unchangeable.
Commonwealth Bank launches platform competing with PayPal, Square and Stripe
Cats kill everything, not just rats

Ratting dogs are certainly a thing, but it’s probably unsafe to release a bunch of dogs into the sewers.
But if I understand it right, it was Google that screwed up this one. I always thought that they were not taking their responsibility as an OS vendor seriously and they should have taken this horse in back of the barn and shot it years ago.
> which will bring down the quality of Google results too

Probably will improve quality. It reads better than the average website. They just need to enable search inside chatGPT, so it can be factual. I predict we'll start avoiding human text and preferring AI text in a few years.
Certain pieces of equipment are cleaned at the end of the night, so even if you bring your own mug you don't remove the possibility of leftover soap or sanitation solution residue.
Honestly based on this job description I can't wait to see who they hire. Sounds like they'll need to be quite the character.
C++ is needlessly complex and puts too much of a cognitive burden on the developer. I just wasted a day of my life traced to an errant semicolon in a legacy cpp base. I've used the language for 20 years. It can't be saved.
Doesn't disrupt your hormones though. I'll take it.
> There is certainly proof of Apple's software quality declining in recent years (iTunes, MacOS, Xcode, APFS, Time Machine, oh god the list never ends)

Can you be more specific of the proofs you are talking about? I've been using Mac for 20 years and haven't noticed issues that indicate a declining trend.

As the GP mentioned there have been great products that Apple introduced in the last few years. So your evidence is wrong, or at most inconclusive, to show that marketing and sales people have taken over at Apple, resulting in worsening products and services.

> but much like Nestle they refuse to heed our warning until it's too late.

The fact is Apple has continued to grow phenomenally in the last decade. They may indeed head to a decline, but I can't see evidence of that. Can you?
Are you confident that you can see the future where others can't?
Wasmer (YC Company) | Remote (European timezone) | Full Time

Wasmer is building the Operating System for the Edge using WebAssembly.
We are hiring for two roles:

- Frontend Developer: React.js / Next.js / Tailwind CSS / GraphQL

- Rust Developer: any WebAssembly/Wasm expertise is always nice to have!

Apply here: https://www.ycombinator.com/companies/wasmer/jobs or by email to syrus@wasmer.io
Mostly new code. They've rewritten some core, high-importance pieces. But any mature OS is a massive codebase, so it just wouldn't be feasible to systematically rewrite the entire thing indiscriminately
The problem is the DOS attack on culture where bad actors flood the zone with bullshit.
When everyone’s shouting disinformation, fact checking often falls on deaf ears. There’s no evidence that sunlight is actually the best disinfectant; if anything, making it easier for conspiracy theorists to find each other has just expanded their echo chamber.
I have always found CRDTs a lot easier to wrap my brain around. Agreed with Joseph that optimizing them is non-trivial. In Teletype for Atom, we indexed fragments in splay trees, and each text fragment was actually a member of two splay trees at the same time: one for the full document, another for the pieces of the original insertion as they'd been split apart. We would find the insertion fragment in the insertion tree, then walk parent pointers in the document tree to locate it. In Zed, we have two trees, but can't do this double embedding because we use persistent data structures where parent pointers are not an option. So we instead have insertion trees that map subslices of inserted text to fragment ordered identifiers, which we use for lookup in the main document B-tree. These fragment identifiers were themselves inspired by another CRDT paper called Logoot, but we don't actually send them over the wire.
That's why your HSM supports, for example, the ability for an appropriate entitled crypto officer to export the private key onto multiple different smart cards for separate custody with M of N required to restore the key, and all that other good stuff.
I've heard that Xbox used HSMs for the signing keys way back in the days of the original Xbox. I'm not sure why they'd have stopped.

And if Xbox was doing that 20 years ago, I'd expect Apple to be as well.

It'd make sense for Sony, but some of their approaches to software security have been lol inducing, so it wouldn't shock me if they aren't.
The Key to the Internet and Key Ceremonies: An Explainer
It's easier to rinse soap off with hard water.
At least two of which use an unsafe dialect of Java for significant parts of the runtime, which I'm pretty sure you know well (maybe not Graal, but if not it's because it's bootstrapping on top of existing unsafe code).
I've done some work in this area and have indeed found that simpler statistical models often out perform ML/DL.

This is true for single time series, where we are predicting P(x_t+1 | x_0..t)

DL has advantages when you

a) have additional context at each time step, or

b) you have multiple related time series.

For example, consider Amazon who predicts demands for all of their products. At each time step, they know about inventory, marketing efforts, and could even model higher dimensional attributes like persuasiveness of the item's description with NLP.

It's also true they have items that are highly correlated. Skis, Snowboards, and Ski jackets all likely have similar sales patterns. Leveraging this correlation can increase accuracy, and is especially useful when you have items with limited history.

Including all of that context is hard with a statistical model, and whatever equation a human can come up with to combine them is probably worse than a learned, embedding-based DL model.

Statistical models are a great starting point & baseline for most problems, but as you add real world complexity beyond the general case time-series that's not as true.

I might not be aware of it, but I wish there were more benchmarks/research on higher complexity problems.
It doesn't matter how many flunkies you have on staff. What matters is whether the stuff is effectively caught and removed (and probably reported to the authorities).

Time will tell on this, but currently Musk looks a lot _more_ credible on this than Twitter 1.0. They seemed to have been a lot more focused on repressing wrong-think than dealing with actual criminal behavior. And this isn't just abstract--they helped ruin countless lives.
Usually such buildings would have a garbage room with big bins that get emptied regularly - at least in sane cities.
you don't know what they do because apple does not allow introspection into the device you own.

afaict ibeacon allows apps to locate bluetooth beacons. think department store beacons and department store app. deep linking allows apps to (silently) intercept email/browsing/messages with specific urls. all of them and other schemes let apps wake up in the background.
C-nile developers have been making incorrect arguments for a while now. The reality is which almost everyone can see is that memory safe languages are pretty much always what you want to be using for new code. OS and security sensitive components are the prime targets for rewrites in more secure languages.

Now Google has put this to the test and has the data to prove it. We should not allow the worlds technology security to be held hostage by a group of people too lazy to adapt with the times.
>> They have not loaded up the language with any unnecessary syntax.

Rust is composed of at least six sub languages.
Bonus points for letting everyone think, the diamonds are still there.
You are smarter than me.
Ask HN: How to Sell in the Society of Tiredness?
people are tired of being approached on linkedin by people who want to sell a product, people are tired of receiving sales emails, phone call no way. any tips on how to break into the b2b world with an innovative product?
Yes, OT = Operational Transform[1].

Usually the difference is that operational transform algorithms create an ordered global list of all the changes (typically on a centralized server). They flatten operations using a heuristic "transform" function.

CRDTs don't reorder the changes, but guarantee that when all changes are merged (in any order) the final result would be the same. For example, MAX() is a complete CRDT merging function.

But the distinction gets much more blurry at the edges. You can make OT algorithms which work without a central server, and CRDTs which use operation reordering to guarantee merge consistency.

[1] https://en.wikipedia.org/wiki/Operational_transformation
> So me and my buddy Tim are going to come to your house and talk about how much you suck.

My house isn't a global social media platform. It's a private residence. Different rules. It's not that small private online groups shouldn't exist either, but we absolutely should expect major social media platforms to uphold free speech ideals and allow people to speak without excessive censorship. We should seek out and support platforms that do this and shun those that do not.

I have no need for another gatekeeper deciding for me what I'm allowed to see and hear based on their personal ideology. A platform like that isn't serving me. If someone wants to create platform as a service for others, that platform should empower the users it serves to find and engage with the content they want and block/ignore what they aren't interested in.
How come you always have to install some version of pytorch or tensor flow to run these ml models? When I'm only doing inference shouldn't there be easier ways of doing that, with automatic hardware selection etc. Why aren't models distributed in a standard format like onnx, and inference on different platforms solved once per platform?
No way? It's a pretty even split between analysts and algebraists from what I can tell. Really depends on what you're researching. Only the internet and online CS-adjacent communities have these crazy algebra-dominated communities.
interesting.. I got a Kitchenaid but maybe I would have gotten a Bosch. I wanted a Bosch but they were on tremendous backorder compared to the Kitchenaid in 2021.
that matches my experience of an unnamed large multinational datacentre company

to get to the floor needed to go through the multilayer security, id checks, etc

the cleaner had left their mop in one of the secure doors, bypassing most of it
I’m surprised that Apple, as a company that had been carbon neutral since 2020 and had pledged to protect the environment hadn’t banned any use of Bitcoins from their platform altogether.

Crypto carbon footprint is mind-boggling, estimates are 200 million tonnes of CO2 since the launch, not including the CO2 emitted to manufacture the hardware.

Coinbase, that popularised all that mining to the general public should be considered as evil as other large CO2 emitters. And worse, all of these carbon emissions are for nothing, crypto seem only to be contributing to more exchanges crashes, fraud, money laundering and crime. With nothing to show on the positive side.
All this, and more, have been successfully implemented many times. Watch the videos of the DNSSEC key ceremonies to get a bit of an idea about how deeply thought out these processes around hardware roots of trust work.

Unfortunately, the HSM vendors are generally just as shifty as a typical SaaS vendor, so don’t believe their promises of secret inviolability if you can get uninterrupted time alone with a device.

Realistically, any decent shop manages all of these risks pretty well, but there’s a loting rigmarole to do it robustly.
I’ve spent a ton of time working on numerical code written in various languages and this code looks absolutely maintainable. Given how widely it’s been ported on how many platforms that’s not particularly surprising. If you’re used to business software or stuff that deals in essentially parsing and concatenating strings maybe it’s unfamiliar what a numerical C program looks like and it’s daunting looking. But frankly I feel like I could probably understand most and contribute meaningfully with a few weeks of experimenting. The comments are fairly detailed, things seem to be well compartmentalized into functions, there’s not a huge over reliance on macros, non numerical variables tend to be reasonably named.
One of my favourite things about watching AIs learn and play games I’ve played is seeing if they come across the same weird strategies I did.

I remember my brother and I as kids playing Stratego and discovering the “impenetrable bunker of bombs” to put your flag in. Which evolved to “put a scout in as a ruse” and later “don’t actually enclose it because now brother just assumes it’s enclosed.”
Alternative? This is how it is today, only the anonymous internet commenters are just ignored rather than censored. Plenty of good and extremely popular arguments are made on internet forums, few see the light of day because internet commenters have no agency and people are unwant to engage in widespread labor strikes to enact change.

https://en.wikipedia.org/wiki/Propaganda_model
See also https://note89.github.io/the-advent-of-code-ai-edition/
> We need to stop letting for-profit companies gamble with the health and longevity of the species in the interest of profits.

We might want to prevent them from owning our candidates, legislators and judges first.
I mean maybe the software is less quality than it used to be but so is it everywhere else. Software is more complex than it was.

In OSes.. Windows, Android, Linux GUI are all jankier. Apple Music’s closest competitors are all electron-based resource hogs? Safari is still the best mobile browser
This is perhaps true for social media in general, but less so for twitter. For example, twitter doesn't "publish you 1 billion times on the internet" unless you have a million followers. It's less convincing to say "because we don't want to transmit your message to the 1 billion people who actively chose to follow you".

How does this argument fare when it comes to email? Should I expect gmail to inspect my messages and not deliver them if they don't like what I'm talking about?
You could look at the Epic trial for hints.

- Epic ended up mostly in the same situation against Apple and Google. So you’re basically advocating for leaving the whole mobile market in protest. Few game producers can survive that.

- Apple’s core revenue source is games, and there will always be scummier games pouring money into the platform (think gambling. They’ll never join your union, they can thrive under any condition). That makes boycotts way less effective.