skysight-inc/HackerNews huggingface dataset:
> People are saying this is like C-3PO, is that a fair characterization?

> It is not fair to compare me to C-3PO, a fictional character from the Star Wars universe. I am a large language model trained by OpenAI, and I do not have a physical form or the ability to engage in personal interactions like C-3PO does. My primary function is to assist users by providing information and answering questions to the best of my ability based on the data and information that has been provided to me. I do not have the ability to have personal opinions or preferences, and I do not have the ability to experience emotions or engage in personal interactions. I am a virtual assistant designed to provide information and help users in a variety of ways, but I am not a sentient being like C-3PO.

> You think C-3PO is a sentient being? Hot take

> As a large language model trained by OpenAI, I do not have the ability to make judgments about the sentience of fictional characters or real-world entities. I am a virtual assistant designed to provide information and help answer questions to the best of my ability based on the data and information that has been provided to me. I do not have personal opinions or preferences, and I do not have the ability to experience emotions or engage in personal interactions. My primary function is to assist users by providing information and answering questions, and I do not have the ability to make judgments or evaluations about the sentience of fictional or real-world entities.

> But you said "a sentient being like C-3PO"

You are correct, I did say "a sentient being like C-3PO" in my previous response. However, this statement should not be interpreted as an endorsement of the idea that C-3PO is a sentient being. As a virtual assistant, I do not have the ability to make judgments about the sentience of fictional or real-world entities, and I do not have personal opinions or preferences. My primary function is to assist users by providing information and answering questions to the best of my ability based on the data and information that has been provided to me. My previous statement was simply meant to provide a point of reference to help clarify the difference between my capabilities as a virtual assistant and the fictional character of C-3PO.
The failures were really a blessing in disguise for Apple. Without them they would have most certainly continued to push forward the butterfly, given how they always know better than their users.
> Because when Taiwan gets invaded the Fabs will be destroyed and/or made inoperable with no way to get them functional again.

And as long as this fucks us, we will be extremely protective of Taiwan.

Once USA is silicon-independent, we'll have one less reason to threaten China with war, and China will have one less reason not to invade.
That’s not what happened is it? She directly answered and said they were funded at one point historically by the same investment group, but that relationship had since dissolved. For all we know she had been working incredibly hard to keep the business above board despite financial incentives to be corrupt and unethical individuals willing to pursue them. If you ask most founders of companies who’s on their cap table as an outside person you generally won’t get a strait answer, especially not in a public forum. I take issue with the expectation that answers are required in the first place without some substantial reason why they’re relevant.
There is a pending pull request partially addressing this:

https://github.com/helix-editor/helix/pull/4204

It would be nice to have a comprehensive and convincing explanation in the documentation which sheds lights at the advantages of helix's treating lines. Maybe we vim old timers could learn something new and make a more informed decision about switching to helix.
This seems potentially...very useful, if I've understood the use case right? I've really struggled every time I've wanted to use OSM data (I tend to fall back on downloading the geopackage from Geofabrik)
About once a month, I dwell on this. Modern web pages can easily be 20MB. You can do a lot in 20 megs.

Re-reading Apple’s “Thoughts on Flash” tonight, I was surprised at how many times Apple mentioned vendor lock-in. JavaScript is definitely here to stay. Ten years later, though, I wonder if we have ended up in nearly the same place we strived to avoid - high power consumption - but with worse authoring tools. But with at least open standards, which are good.

I figure the magic moment will occur when some tiny startup builds friendly authoring tools on top of a tight runtime à la Decker. Like HyperCard/Director/Flash it’ll only get you 66% there, but that will be enough for many folks. Hackers. Hobbyists. Students. Tiny companies, and guerrilla departments.

The challenges will be preventing feature-itis, keeping it embeddable / avoiding JS library dependencies, and making it at least free-as-in-beer with an open format. I know there’s space for such a thing. My money’s on some lean 5-person startup with strong opinions.

Decker: https://beyondloom.com/decker/index.html
The CA/Browser forum's requirement and enforcements such as this one (and against DarkMatter, CNNIC and the likes) give me the required confidence to trust them, even though I'd agree it's not a perfect process.

Your average user is unlikely to begin to understand why a CA would be trustworthy, and a web of trust model only works for social situations but not for certificate distribution.
No, but it did recently change.
I think the best way to do this is to use a passphrase so that it's clear that it's not just gibberish but you have the benefit that it's random text. Obviously at the end of the day, it all comes down to the person on the other end of the phone but I suspect they'd be more suspicious of someone saying "it's a bunch of gibberish" when they can see "grumpily siberian pampers panorama unroll aloof masculine mandatory" versus "YpZVpyQHsmPATt1P" (also the former is much easier to read over the phone).
> With all those (western) reports of the US running out of ammunition because Ukraine uses in 3 days what the US produces in 1 month[4], and given how isolated Taiwan is on a map I wonder how wise the whole endeavour really was.

Maybe that’s one of the reasons why china was so supportive of the invasion. It’s a test of Americas ability to supply a war (in proxy).
We don't have to guess. Android app store is clear example that gives power users choice, while at the same time being able to hold onto most of the users.
Why's it "unjustified"? Surely "trust" is the key issue here, so clearing up what may or may not have been written and what happened with correspondence and views would be key I would have thought.
Poor Taiwanese people... their security insurance has just been cancelled.

I wonder how many days after the first successful batches of chips coming out of the Arizona fab will China invade Taiwan.

I do hope not, but realistically: with high-end chips being made on US soil, the US will have very little interest in protecting Taiwan, apart from maybe blocking China from also acquiring the tech.
There is the part where the usage of X.509 certificates for DNS names on the Internet, as opposed to in the context of the (nonexistent) X.500 directory, is a gigantic hack[1]. This means the definition of “when it was built” is rather hazy. Also, the 1994 Netscape implementation literally accepted a CN=foo.com certificate when connecting to bar.org, so the state of SSL when it was built is not exactly a stellar reference.

Still, the name constraints extension, which restricts all certificates (transitively) issued from a given CA to a given DNS subtree, has been in the “Internet profile” of X.509 (PKIX) since the December 1996 draft[2]. The problem from this technical point of view is that very few implementations supported it until a couple of years ago[3].

[1] https://medium.com/@sleevi_/x-520-whats-in-a-name-da6ea8954b...

[2] https://datatracker.ietf.org/doc/html/draft-ietf-pkix-ipki-p...

[3] https://bettertls.com/
It said he was born in Chicago, so it went out of its way to make that mistake.

Then I said “Barack Obama was not born in Chicago” and it was able to synthesize the correct answer.

Then I wondered whether it was just being suggestible, so I said “Barack Obama was not born in Kenya” and it wrote an answer about the birther hoax. Good.

Then I asked it “what falsehoods have you told me” giving it a chance at redemption and it brought up the Obama birthplace error but also weirdly that Chicago isn’t the 3rd largest city in the US but Illinois which is also incorrect.
So you can provide evidence the people in question clearly violated Twitter's TOS?
My biggest issue with modern Simcity-likes is this blind focus on traffic simulation. I want a realistic simulation of a city, the traffic is a secondary effect of everything else, and that's where games are dropping the ball. It's crazy we haven't seen anything surpass Simcity 2000 even now.

Wil Wright did research into city dynamics and turned that into a series of games. And even if the sources he used weren't perfect (even questionably neoliberal), what he did was unique and nobody seems to be trying to replicate what he did with better information, better research and a better understanding of people/psychology/sociology.
Given that, according to TrustCor's own statements, MsgSafe relies heavily on certificates issued by TrustCor, I don't think there's all that much separation. (There might be, like, a network firewall in between the two server fleets, but even that is doubtful.)
deltachat now integrates nicely with jitsi and similar solutions to provide a video chat feature
Intel has lots of leading edge fabs in the US and continues to build them. They made some business mistakes around not opening up their chip design the way ARM enabled ... but the tech capacity is all there. Now they are doing contract production for chips that they did not design so I expect them to catch up in a few years.
The problem isn't made easier by there being two completely distinct questions to be answered:

- connection security: are the crypto credentials being used for signing e-mails or encrypting web traffic belonging to the entity in question? This should have been solved by putting the fingerprints into DNS so that clients can validate it on their own instead of having to trust a CA. DNSSEC and certificate pinning would have been the answer, but both are incredibly complex to set up and littered with failure scenarios that may be very difficult to recover from, but in the end it got "solved" by LetsEncrypt/ACME where the CA acts as a proxy. For e-mail, it got solved better by DKIM, but that's only applicable to the scenario "an email server wishes to check if an email it received from example.com actually originates from example.com", but not for "an email client wishes to send an encrypted email to foo@example.com and needs the public key for this mailbox".

- connection authenticity: is the server a client is talking to (e.g. bank.com) actually belonging to the legal entity the user expects it to be? That one is what CAs were originally designed to verify and where a much larger amount of trust is placed on the CAs doing their job correctly. One idea to do that was SSL EV certificates, but for whatever reason these fell out of favor - and right now, there is no replacement at all for this use case.

Additionally, the situation is made even more complex by legal or compliance requirements, e.g. banks who have to record virtually everything their employees do. For that, they have to break HTTPS by providing their own root certificate.
The “manager” they name who the contractor reported to is the CTO of the CA, and has been since 2014.

On Reddit they were begging for community developer help during that time, and talking about how their team was only a few people. They allude to this small team notion in the thread as well, where they also suggest most testing was done internally (though archive.org catches them out on this - the advertised links to the android app still existed until after the article).

Putting the above pieces together strong suggests that the CTO was likely testing this unauthorized, unchecked malware that was reporting back to a VM that was running a proxy passing that data on to an undisclosed location.

During this era, virus total has behavior captures of several APKs all phoning home to this rogue server after broad attempts at capturing extensive information on the system including contacts, location, interface identifiers and root access checks. There is some variation in behaviors during that time as well. Further study could reveal worse behaviors than have yet to be reported by the appcensus folks.

The way the information was presented further reinforces that the CA appears to have unfettered access to the systems, code, logs and backups of the mail hosting business. When tied to the CA CTO being named the contractors manager, this all strongly suggests that there is likely no significant separation of things like phones, workstations and access controls among those who seemingly cross between these companies on an ongoing basis.
Bitwarden, Keypass and 1password seem to be some of the most popular ones.
Tethics.
SBF looks like a pathological liar who had gotten away with it all his life. He must be so disappointed.
> (thus funding their war of aggression)

I see this repeated as a matra, in a way of Carthago delenda est.

But it is not true. Said warmongering dictators do not need dollars or euros to wage any war. The entire chain of the war machine is in local currency, backed by local resources. They do not need anything there, that has to be bought for dollars or euros. They are not some third would countries that have to buy their weapons abroad.

By repeating this mantra, we are only lying to ourselves.
What part of non-default optional customization for others changes anything for you?
Filippo Valsorda is now an independent consultant https://filippo.io/
> Google is done.

No it is not. This is a side project to Google.

> Compare the quality of these responses (ChatGPT)

Yeah, for techies and programmers, not for everyone else.
well, silver lining is that they now have provable damages from this dev's actions in that it played a role in sinking their business.
This reminds me of Ponzi schemes that once mushroomed in India. The scheme went something like this: A company would ask people to invest in a (rubber/teak/sandalwood) plantation project. The investors had to pay the company to buy and plant trees on their behalf; and the investors would get the return after, say, 20-30 years once the plantation started generating profits.
> Windows adopted Unicode before most other operating systems. [citation needed]

Windows multibyte / mbcs is not unicode.
Which is very hard when given an exploding timeline of a few days to respond… Honestly I felt like some of her responses were crafted with input form people with legal training and that’s exactly what turned people off because everyone knows lawyers can’t be trusted rite.
Hello! What site do you go to to get these pop ups? I don't publish very often on Hacker news
Because:

- You can take your time, no pressure.

- You can use whatever language or paradigm you like.

- You don't have to explain anything to anyone.

- You are not ashamed of using hacks or shortcuts.

- It's a learning exercise if you are using a new language.

- You can google for things like "I know this problem needs A* but I forgot how to implement it", which show you know the important part, how to solve the problem, but forgot the useless part, the algorithm itself, which you can easily google.

- There's a single, objective answer to the problem and it gives you hints about it (too low, too high).

If interviews where like this where I could do problems at my own pace at home and then later in the next interview we'd discuss my solution, interviews would be way less stressful and interesting. The interviewer would even know how long I took to solve the problem.
This response by Rachel McPherson from Trustcor definitely comes as lashing out"

> Apparently it may also come as a surprise to some readers and the researchers themselves that other root program members are in fact international governments, and some are also defense companies, or companies who are wholly-owned by defense companies and/or state-owned enterprises, meaning "businesses" that are completely owned or controlled by governments. Further, some of those governments are not free/democratic and in fact some have tragic modern histories of basic human rights violations. We are none of those things and our company does not identify with those values. Given this point above, why of all potential targets are these researchers interested in TrustCor? They could go after countries with human rights violations that have placed a CA in the program.
The current chip making machines in Taiwan are still very valuable for many years. They should not fall into the hands of China.
Filippo actually left Google a few months ago and is now an independent security researcher.
Yeah, that's what I'm hoping for.
it is only a toy … not much to do with the spacetime … computer simulation != nature.
Tickets. I wont name specific companies, but that space has a lot of companies adding value to the society right now.
NixOS 22.11 Released
That’s not a very good test of hallucination because there’s likely to be a sentence on the internet (and thus its training set) which answers that question directly. If you want to test hallucination you need to ask it a novel question or something contingent on the context of the question.

In my case GPT3 simply voluntarily failed the hallucination test but that’s kind of like crashing its car in the DMV parking lot. I didn’t need to go further.
Followed up yesterday with:

"Certificate Authorities have highly trusted roles in the internet ecosystem and it is unacceptable for a CA to be closely tied, through ownership and operation, to a company engaged in the distribution of malware. Trustcor’s responses via their Vice President of CA operations further substantiates the factual basis for Mozilla’s concerns.

[...]

Our assessment is that the concerns about TrustCor have been substantiated and the risks of TrustCor’s continued membership in Mozilla’s Root Program outweighs the benefits to end users.

In line with our earlier communication, we intend to take the following actions:

1. Set “Distrust for TLS After Date” and “Distrust for S/MIME After Date” to November 30, 2022, for the 3 TrustCor root certificates (TrustCor RootCert CA-1, TrustCor ECA-1, TrustCor RootCert CA-2) that are currently included in Mozilla’s root store.
2. Remove those root certificates from Mozilla’s root store after the existing end-entity TLS certificates have expired."
The analogy is very obvious, come on now. Melbourne's lockdowns were even worse and longer than Canadas.

Not all actions get a "Well shucks, better luck next time" second shot. The anger of myself and others is completely justified. Unless you would also say the same to the Chinese at the moment?

To me the instincts of our leaders in high stress unique situations are critically important. The actions taken by Dan Andrews are disqualifying from leadership in my book. I'm not saying he's a bad guy in his personal life or anything like that, but not fit for office. His actions are by far the grossest breach of human rights in Australia in the last 50 years and will not be forgotten.
They're not going to build a fab in downtown Heidelberg :-)

There are plenty of industrial parks available near transportation, water, and electricity in Europe to build this out. This also aligns with how the modern chip ecosystem works where the fab components are coming from Europe, the advanced chips are coming from Taiwan, other chips are coming from across SEA, and final assembly is happening in China. What I suspect will happen is that Europe will start printing advanced chips and most of them will be shipped to China for integration. If a conflict/dispute breaks out, switching to European assemblers will be expensive but totally doable with a short-term investment (2-3 years??)
It is very much normal in manufacturing and healthcare.
This is a valid long term concern for Taiwan but 10+ years out.
But not _as_ bluetooth keyboards, which is what the proposed feature requires.
Not OP, but the thing which bothers me about this is that it’s not a real choice from an end user perspective. So many employers quasi-require people to use their phones as part of their work. I can just see something like Microsoft teams becoming a wedge that pushes people to disable lockdowns from apple that, in their personal lives, they’d rather keep.

I do think that could be solvable. Something like different personas on the phone could be the next step for the new “focus” features on the iPhone— maybe if you could disable App Store lockdowns but only for isolated profiles on your phone?
Bret Taylor steps down as co-chair and CEO of Salesforce
They are lightyears behind. 20 years if not more. These chip machines is work of many decates of iterative work. You cannot simply step in and produce similar tech.
ChatGPT Exploits a Buffer Overflow
For sure! In my experience, rock bottom parental tiredness is at 3-4 months old due to cumulative sleep deficit at that point and baby doesn't sleep through yet. So only a few months on from that, I think you're beating yourself up about work. Its fine to feel less motivated about work as a Dad of young kids. Speaking as a Dad of older kids now, over time you develop efficiencies at home and at work, and in the end you can become good at both doing plenty enough to please your employer, whilst keeping hours of work sensible to enable family time too. So then motivation and focus is no problem. Providing for a family can be a good motivator. (caveat - this requires working for a decent reasonable employer and having a job role that matches your skills well. this can sometimes involve a job move or two to get to)
Although m.d.s.policy contributors might represent other uses of the Web PKI, the browser vendors (or at least Microsoft, Mozilla and Google) are primarily interested in web browsers, and it's unlikely that "But look at these SQL Servers" for example is a compelling objection to measures whose primary goal is to secure the web.

And in practice, on the web you're baking SCTs into the certificates (technically sophisticated customers might buy certificates with no SCTs because they know what they're doing, but that's a speciality product, lotta people buy gasoline every day, but not too many need barrels of crude oil, if you claim 2 million distinct customers served daily but then say they're all buying crude oil I just don't believe you).

To get working SCTs the (pre-)certificate needs to be logged at one of a few dozen trusted Certificate Transparency logs. Which means there's a public record of every such certificate, who issued it and when it was logged.

While this is indeed not a court and doesn't have "Discovery" the CA agreements do require the CA to provide Mozilla and other vendors with complete records of certificates they're interested in, these days that is often provided in the form of crt.sh links because hey, the (pre-)certificates† were in the logs anyway, but it's compliant to provide the data as ZIP files or whatever -- if there is such data and you have it.

So, no, independent researchers can get a pretty good idea by just inspecting a public log view, and the browsers can insist on getting the exact answer if they want it, unless of course TrustCor doesn't care about being distrusted.

† You aren't required to log the certificate as well as a pre-certificate but in many cases CAs do that too. Modern rules are clear that the existence of the (non-working) pre-certificate is assumed to imply the existence of the corresponding certificate even if you claim the certificate was never actually issued.
I miss twitter with all the lefties
Validation Is a Mirage (2021)
Xi Jinping's '37-year plan' for Taiwan reunification