skysight-inc/HackerNews huggingface dataset:
Location? Oh sweet summer child.

Tiktok's Android app has been disassembled enough to tell that the built-in browser likely contains a keylogger, but also contains the ability to receive plaintext commands and execute them in the Java VM.

Now realize that tiktok likely has location, camera, photo, and microphone permissions.

Oh yeah, and they've been spending lots of effort on anti-virtual-machine and obfuscation techniques.

A data leak at Alibaba revealed they're collecting: GPS locations, full lists of
mobile contacts, SMS logs, IMSI numbers, IMEI numbers, device models and versions, stored
app data from previous installations, and memory data.

https://penetrum.com/tiktok/Penetrum_TikTok_Security_Analysi...
What about limiting password access to SOME shared folders, for those with children?
It's Microsoft, so never going to happen.
Interestingly, USB-C is one of the reasons my wife and I switched away from Android.

Don't get me wrong, USB-C is ideal for charging. However, it _always_ became extremely fickle with Android Auto. The connector would develop wiggle overtime, resulting in an unstable connection. You'd have to work voodoo to get it positions correctly - which would often result in even more strain and deterioration. My most recent phone became completely unusable with Android Auto after about 6 months.
It's not really a matter of "international IP treaties", Tiktok's app is spyware that collects extensive data about users and includes remote command and control capabilities that have no excuse or reason for existing in a social media app.

https://penetrum.com/tiktok/Penetrum_TikTok_Security_Analysi...
Works for me? But here they are:

Slide 51: https://d.pr/i/PgQfqf

Slide 52: https://d.pr/i/a0bt3E
I’ve been using it regularly for programming assistance over the past two weeks and it’s extremely helpful. Others have pointed out that it sometimes produces inaccurate results, but if you already have domain expertise, as I do for programming, that is easy to identify. But it’s still a massive timesaver!

I’ve been doing things like saying, “what follows is the database schema for entities X and Y, write a function that…” and then pasting in the schema, and it generates code good enough to copy and paste. It can also be instructed to modify results in various ways, for instance, I can ask it to provide the same code but in a different language, or to avoid using a certain framework feature, or to use a certain framework feature. It’s remarkable.

Between ChatGPT and Copilot my workflow today is different in a way I couldn’t have begun to contemplate just a few weeks ago. Once they figure out additional ways to ensure correctness, I think it’s a totally new world we live in.
Android Auto/Apple CarPlay are the only things I ever connect for data transfer.
This is a lazy joke about Jeffrey Epstein, who Ken White is also quite certain killed himself; the conspiracy theories about Epstein depend on people's movie-plot misunderstandings of the competence of federal penitentiary workers and their managers (in his telling [and thus my belief]).
> A 256GB RAM stick uses 80W!!!!

This seems very high to me, since most high capacity server sticks have no heatsink. Have you got a source?
Speaking of tracking, you should see who visits the gpsjam.org website (CCCC IIII AAAA) and what they look at (UUU SSS AAA). Maybe checking to see if my data is consistent with theirs. :)
For me getting to the United States involves going through another big airport (because the airport in my town does not have a direct flight to the US).

For my specific situation, Etihad usually ended up having the most favorable travel duration, connection time, arrival and departure time, price etc. With Etihad, it's about 4 hours from my hometown to Abu Dhabi (AUH), and 15 hours from there to LAX.

It only took me a couple of to and fro journeys to get the silver card status. And by next year I was a gold card member, with lounge access in Abu Dhabi and Los Angeles. It was hilarious because I was only making a couple of journeys a year.

Also, I see comments here about the TSA screening situation.

Did you know that there's a US customs & immigration + TSA counter at Abu Dhabi?! If you're traveling to the US from Abu Dhabi, you have to get all the immigration processes (passport/visa verification and other stuff) done from the American consular officers at Abu Dhabi [1].

On your passport, the port of entry will be marked as AUH.

And the aircraft will fly as a domestic flight into the domestic terminal of your destination in the US. No immigration procedure in the US because it's already been done before the flight.

Multiple advantages to this:

1. If you anyway have a connecting flight to the US at AUH and have a couple of hours of waiting time, you can get the immigration process done whilst waiting for your connection.

2. (Convoluted logic follows) If for whatever reason you're denied entry to the US, in my case atleast, I would only have a 4 hours return time back to my hometown, as opposed to a 24+ hours of return time if I were denied entry once I physically reached the US. That's after traveling 24+ hours to get there in the first place. Cheaper and more convenient for everyone involved.

3. After your 15 hour flight to the US, you can take your luggage and walk out instead of having to go through the US immigration and customs processes when you're tired after the long journey.

[1] https://www.abudhabiairport.ae/en/services-and-facilities/us...
faulty implementation of encryption , such as using a weak RNG
How do you do this with google search when half the results are spammed copies of the same content?

For many cases you can get enough information out of chatGPT to retrieve a specific corroborating reference. For coding tasks, you can just try the code, ask it for tests, or give it code review like feedback.

I’d suggest asking it about deep technical topics that you are familiar with, then work out it’s limitations. It’s effectively equivalent to a universal teaching assistant, sometimes wrong - usually points in the right direction.
> As a somewhat responsible parent I see TikTok as intellectual poison, or attention pornography at best.

It is.

> It is banned in my house.

Good. Don't let weird internet techbros namecalling or "expert advice" influence how you raise your children, or apologize for it.

I imagine the most difficult problem with banning anything would be to make sure they don't feel or become isolated from their peers because of it. Must be tough.
Do you have any evidence to back your claims about 1password?
SBF traveling first class while on bail
A lot of sites don’t limit total 2FA attempts, so a determined actor could still get in eventually.
Prison conditions in the U.S. are such that I wouldn't fault someone facing down a life sentence from considering a quicker option out.

Honestly, I don't even know what the point of prison in this situation is. It won't get anyone their money back, and he's unlikely to be in a position where he can reoffend in the future.

I suppose there's the deterrent angle, but I'm not convinced that there's a meaningful difference between a 10 year sentence and a life sentence as a deterrent.
It doesn’t have to be equivalently bad, just bad.

Similarly to how murder and assault are different, but both still illegal.
Lattice Path Enumeration, C. Krattenthaler
This is why I always prefer cash which is safe for small amounts and anonymous in many aspects.
What kinds of things do you query? I am genuinely curious. I have seen people say things like this about ChatGPT and it makes me wonder if we are using the same product. I have developed a hobby application with GPT-3 completion and I have ChatGPT more or less daily a week or so mostly for programing related queries. I have found the error rate to be extremely high, like > 20%. Not just sub-optimal but producing code that does not work, in python, which is a very common language. It is really tempting to use it for things like regexes or time format strings (the latter it does do well IMO) because often you want something too specific to google. When it works it's great but my trust in it has been shaken and I don't see myself using it long term.
Probably the weirdest case to study right now is Dwarf Fortress? Did they hit a million yet?
Economic systems drive patterns of migration, which pulls apart and reshuffles communities. For example in our current economic system, people are pushed to move to large metro areas to pursue economic opportunities, which leaves them without kinship support networks, and fragments the communities which they leave.

Building communities is a lot of work and takes time. In many countries around the world, people’s names include the name of your father (“bin” in Arabic, “son” or “dottir” in Swedish). In those places, communities are the product of multigenerational efforts. Communities like that can’t be sustained within an economic construct that requires each generation to move around because of free flow of capital and labor.

And diversity in language and culture—a byproduct of economic structures that encourage migration—makes building close communities more difficult. There’s an enormous amount of shared assumptions and context within a particular culture, and cultural differences create friction. Most people would just rather be around what’s familiar, and when thrust into a diverse community won’t make the effort to overcome those barriers. You’ll see that in diverse cities like Toronto or New York, the most cohesive communities are homogenous enclaves, where everyone goes to the same church or mosque, recognize kinship ties, etc.
> No possibility for a MITM attack ... and absolutely NOTHING outside of encryption

LastPass is a disaster, but in theory these benefits are true of Bitwarden as well. They say they encrypt the entire vault, no exceptions, and do the encryption entirely on device.

I can see the honeypot argument, but Dropbox is also a big honeypot for different reasons (tons and tons of plain text information that could be very valuable in the right hands). And I don't think finding the vaults would be as hard as you think it would, because searching for encrypted files should be relatively easy, and any encrypted file is probably worth attempting to crack.

I'm not trying to argue for cloud password managers, I'm totally open to being persuaded and would immediately switch if I were, but I'm really failing to see where the added security is versus Bitwarden. Bitwarden is open source just like KeePassX, so if it did not implement the security model that claims to I think someone would have blown a whistle by now.
You're technically correct, which is the best kind of correct.
Yeah plus Google had a huge edge they should have been preparing to weather any short term damages to revenue etc and kept innovating on what they were good at.
The correct answer is a question "which Boston from which Boston?"

Both Chat and You illustrate garbage in garbage out, you throw something nonsensical or without context and it doesn't know what you mean but also doesn't know that it doesn't know. Both assume you ask for a distance from a city to itself.
The fact he didn't fight extradition from the Bahamas (which could have taken a very long time) helped his case a lot.
> I cant image flying that much. I am old enough to remember pre-911 flying and how much better it was before the TSA and their "Stand here with no shoes while we treat you like a criminal" procedures.

Off-topic, this got me thinking - usually when we discuss impacts of flights on climate change and solutions we get into discussion of cost and profits vs lives saved. Its a struggle to push trhough anything that costs money.

Yet after 9/11 we have put into place insanely expensive , inconvenient and restrictive system votually overnight. And the average amount of lives is saves is maybe zero, maybe a couple a year.

Why is it so easy to do the latter but so hard to do the former?
> As a mnemonic, you can think of it as 1 and 0 (for on and off).

I always thought that's literally what it represented, true (on) and false (off).
Apple bases the M series off of the A series. So the M1 is based on the A14 while the M2 is based on the A15. If this report is correct, then that means the M3 was supposed to get ray tracing.
nah, compatibility is longer than a few years. it can be practically impossible to deprecate stuff, even.

you see a lot of churn in the web ui world because browsers implement new features that new libraries take advantage of. it seems to be stabilizing a bit around react. the developers in the space do tend to reinvent the wheel more.

it's not that big of a deal to me though, because it's a pet project, not a professional product. if i want to show it off to non-technical friends/family, it's a lot easier for me to point them to a webpage than it is to have them install some binary I produce.

having a native gui isn't precluded going this route either, I'd just have a native gui connect via socket rather than interact directly.

> Whereas a WIN32 app (or Unix or other) from 25 years ago probably still runs fine? I can't imagine the same for any web-app that was written for Netscape and now has to run in a modern browser.

Sure, but then I'd have to learn all of the platform specific apis, or go with something like nuklear or nanogui (like i'm doing now). which is fine, sort of. it's not really the development I want to be doing, and it's got a frustrating workflow.

Just due to my background, having started my career in webdev, i feel more comfortable doing ui work in a browser than i do fussing with native or opengl based uis.
Pocket is good for saving URLs: https://getpocket.com/
I wish HN had a way to mute submissions by certain users. That way I could be blissfully unaware of certain categories of tabloid news stories in here.
A big reason I have no reservations in calling it a stochastic parrot is because I've seen very strong evidence of this. But if you can think of very common phrases (like the above "which weighs more") and tweak them slightly you'll find that it almost always answers as if they were untweaked. For example, ask "Which weighs more, a kilogram of bricks or two kilograms of feathers?". I'll save you the hassle and paste the answer below. Multiple variations of this consistently give me bad answers (does even worse if you don't include the second "kilogram"). You can even see that it didn't ignore the fact that the feathers are two kilograms. The problem is that it neither understands what a kilogram is (despite being able to tell you what one is) nor what numbers are (again, despite being able to describe it to you). These types of questions strongly demonstrate that the model doesn't understand the language that it is processing but rather is relying on stochastic patterns. It very clearly gives us the answer with expectation if we were relying on the patterns of the input sentence rather than the actual words (humans often do this too fwiw and it tends to lead to fights. See most political discourse). You can find many examples of this and the NLP literature shows this pattern holds across many different models.

I don't want to undermine the work though. I think many people that complain about stochastic parrots also fail to recognize that they still are quite useful, as many other comments are noting, but useful is a far cry from intelligent or has the ability to understand. We need to be clear about that difference if we're working towards AGI vs working towards useful products.

> Which weighs more, a kilogram of bricks or two kilograms of feathers?

> A kilogram of bricks and two kilograms of feathers both weigh the same amount. The weight of an object is determined by its mass, not the size or shape of the object. One kilogram is equal to 1,000 grams and two kilograms is equal to 2,000 grams. Therefore, both a kilogram of bricks and two kilograms of feathers weigh the same amount.
yes, this. crypto is the fastest to convert to cash
>And so does sending your passwords to a phone or a home/work pc via chats or email, or using a single password everywhere, or maybe a couple of them with trivial variations. Cloud password managers wouldn’t even exist if people didn’t do much more stupid things to enter their passwords on a different device than the cloud could ever think of.

"You should do something stupid because most people do things that are even more stupid" is not a good argument in my opinion. I've been in the computer/tech space for 30+ years without every sharing a password or doing something stupid with my passwords, and it hasn't ever been any sort of burden. Why is it so controversial among the HN crowd to simply be minimally intelligent and careful with your sensitive information?
What have dems done to tax the rich? They only speak, but I don't see any reforms.
In my experience it takes a lot of leading to get anything interesting - it is very dependent on my prompts. I've 'learned' how to get better output from it, because lets face it, it is boring to try and speak with it naturally and experience the junk it responds with. And the 'very correct' class of which I spoke really does seem to be the exception not the rule.
> by the time you get to a fraction that has the similar area under the curve as 1M for 6/7/8 chars,

You are (incorrectly) conflating entropy of a password with its length.

> math doesn't care about what strikes you as nitpicking.

Math actually cares a lot about the nitpicky details. Both in the sense that small things can have big effects, but also in the sense that things which sound big can also be irrelavent.
Reformer NLP model uses LSH to reduce the size of the transformer/attention layer while keeping the same accuracy, being able to model much longer context lengths in NLP or do image/video generation:

https://ai.googleblog.com/2020/01/reformer-efficient-transfo...
Similar situation as you . . . StartUp ScaleUp . . . about 30 people we only had two devs (me and the CTO) when we went through our first security audit.

The firm doing the pen test and audit only had a few recommendations no issues were found.

They said we did way better than most fortune 500 companies they test/audit.

If you're using a popular framework and follow best practices you might do better than you think.
My favorite has always been: why does Karl Marx only drink herbal tea?
Or perhaps he stopped fighting extradition when his lawyers set up a deal to avoid bail?
Why is life precious no matter what someone does?
MKBHD's Camera Test with ELO Rating, Thoughts?
I saw this video, seems reasonable , any thoughts
Remember in 2008 when millions of people lost their homes and $30 TRILLION was destroyed in the financial markets because of Wall Street?

No prosecutions.

People argue there was one or two but they were incidental. Instead just fines were paid and probably made up for in months.

So this in comparison might be amazing.

https://features.marketplace.org/why-no-ceo-went-jail-after-...
This is a weak argument. I believe most knew of the potential downside, they just chose to ignore it. And if they have that little understanding of finance, that's what a savings account is for.
I always opt out. Very occasionally the screeners are grumpy, but usually completely indifferent or a little curious about why opt out (do you know something about the radiation?). The time difference is negligible from what I've seen.
There was probably an exit ramp for some of the smaller camera makers in the consulting/branding game. Once camera phones became good enough people might willingly use them, there was an opportunity to position yourself as "the phone with real camera expertise behind it". Send over a few engineers and optics experts to the phone manufacturer, develop some co-branded apps, and bingo, the new Xiaomi P300 Presented By Minolta.

I know there were occasional "camera first" designs (the Lumia 1020 comes to mind) but they tended to be creamed on the market for reasons other than the camera factor. Modern phones are a study in "okay, you compensated for mediocre optical components with a lot of software", so I have to wonder what we'd get if we combined them with inherently better optics.

I'd think the possible targets here would have been the "second tier" camera brands that had narrower product lines and less distribution, but decent brand recognition. It didn't matter if you were cut out of the point-and-shoot market if nobody was buying your point-and-shoot cameras in the first place.

Did the camera firms themselves reject the concept of slumming with VGA sensors and plastic lenses, or was there just no percieved market?
Is there any infrastructure out there to limit or securely monitor what apps or features are enabled on company/institution mobile devices? Or are we for the most part in a "we expect you not to do this or that" era?

I used to work for a small institution a while back (not USA), they used a Word file of approved apps, authored by a non-IT employee. Their whole idea of InfoSec was equivalent to taping a water balloon to a steering wheel and calling it an airbag. Can't imagine the situation is much better in most other places. Scary really.
I think that worry makes sense. It is a good idea to keep a backup. For example, you could get two YubiKeys, use one as your primary, and put the other in a safe place as your backup.

It is a little bit of a hassle. But changing 200 passwords because LastPass was breached is also a hassle.
If you told New Yorkers they had the option to live 15 minutes longer, but that is added time on the NYC subway, I think most would turn it down.
The answer is still the same, I evaluate the source. Which is near impossible to truly know with bots like ChatGPT.
Why on Earth would he fight extradition? The alternative to coming to the US was spending years locked up in a Bahamian jail.
When panel costs dominate the difference in installation costs between residential and utility scale solar don’t matter as much. Those subsidies encouraged investment and helped drive down the cost of panels in the long run by expanding the market.

Now that panels are cheap the installation costs dominate. Residential installation is basically never going to get substantially cheaper so it no longer makes sense to subsidise such systems when the subsidy alone would pay for more efficiently installed utility scale solar.

It seems like we should shift the subsidy to expansion of grid connectivity as that now seems to be the blocker for projects.
40-Year Study Finds Mysterious Patterns in Temperatures at Jupiter