skysight-inc/HackerNews huggingface dataset:
I believe my most vulnerable environment is the development environment. 3rd party code being updated almost constantly combined with fairly standardized cli to cloud environments (kubectl, az/aws/Heroku, gh, etc.

And I don’t just have to be vigilant about what I do, but also about what my team has done. It terrifies me, and it’s a sad reality that my personal risk is reduced by the fact that if I fall victim, countless other teams will as well.
Waiting for HackGPT to become a thing, so I can use it as a pentester.

Any ways in which AI can already help?
What should you do when another site copies your content like this then?
What bugs me is when this is applied to remote workers in a way that seems optimized for in-office environments.

For example IT enforces that your screen becomes locked after 15 minutes of inactivity and also ties in your local computer 's user login password to your SSO login to access everything. It's a contradiction around password best practices. If you force people to input their password multiple times a day then naturally people will gravitate towards easier to type passwords.

If the idea is "but what if you go AFK in a public place and forget to lock your screen?!?", that's not a valid reason. If you were working in a coffee shop and went to use the restroom for 4 minutes or turned your back for 2 minutes then your machine could be compromised (or even worse stolen). It's extremely reckless to leave your gear unattended in a public place.

It can really break morale to input your password and MFA half a dozen times a day, especially when you're alone in a locked apartment where the laptop hasn't left that location in a year.
Display behind the truck shows the front so that you can decide to overtake it
You send a DMCA.
tl;dr: Stephanie Warriner was restrained for not wearing her mask. Afterwards her lifeless body is wheeled away. A coroner's report stated she died from a brain injury resulting from a lack of oxygen "due to restraint asphyxia following struggle and exertion.”
I’ve understood monads multiple times in my life, but each time that understanding was so fragile that it crumbled when I tried explaining to someone else.

I’m currently in a phase where I don’t understand them.
Show HN: More than 250 GPT-3 generated paper summaries
Hi there,

I wanted to share my new project with you, it is called arxiv-summary.com. Right now, I find it really difficult to keep up with all the important new publications in our field. Especially, it is sometimes difficult to get an overview of a paper to decide if it's worth reading. I really like arxiv-sanity by Andrej Karpathy, but even with that, it can still take some time to understand the main ideas and contributions from the abstract. With arxiv-summary, my goal is to make ML research papers more "human-parsable".

The website works by fetching new papers daily from arxiv.org, using PapersWithCode to filter out the most relevant ones. Then, I parse the papers' pdf and LaTeX source code to extract relevant sections and subsections. GPT-3 then summarizes each section and subsection as bullet points, which are finally compiled into a blog post and uploaded to the site.

You can check out the site at arxiv-summary.com and see for yourself. There's also a search page and an archive page where you can get a chronological overview. If you have any feedback or questions, I'd be happy to hear them. Also, if you work at OpenAI and could gift me some more tokens, that would be much appreciated :D

Thanks and happy reading!
Yes, Yes! Just 6$ for 330ml/12 fl oz You try it 1st ;->
An important distinction is that one is a device you choose to add to the system, and the other is an offer you can’t refuse.
SOC2 is relatively minimal. You describe your policies and controls, the auditor verifies that they meet some baseline requirements of generic "best practices" appropriate to your risk profile, then they collect data during the observation window to verify that you actually adhere to them.

In this case, I imagine that CircleCI's controls involved developer workstations having anti-malware software, logs and audit trails for access to production systems, and some kind of intrusion detection system around those, and some SLAs and policies on how they react to alerts from those systems. It sounds like they had all of those things in place but the malware wasn't detected and their IDS didn't pick up the external access. Unfortunate, but both of those are entirely possible in many environments. SOC2 can't guarantee that your anti-malware systems or IDS are flawless and can't be bypassed by a clever attacker. Otherwise, since they've been able to identify what the attackers gained access to, it sounds like they did have logs and audit trails in place.

SOC2 auditors typically only have a limited understanding of security and technology themselves (the higher end ones might have more resources available to them) and are only able to sample a small amount of data during the observation window.

If you're trusting your sensitive data and credentials to a 3rd party, you should definitely require that they have SOC2 or better, but you still have to own your own security and consider how you need to protect yourself if/when they are compromised.
Oh you're the Forth expert? Well you wouldn't know if I were one or not, nor how likely. But what a little clique you make it sound like; a very exclusive club.
Why would it? Calculating the first few trillion digits may be (and probably is) a lot faster than doing a trillion calculations of individual digits, but even if it isn’t, people will simply raise the bar and compute even more digits.

> What will the super computers going to do in view of this discovery?

Whatever they do now. It’s not like this is what supercomputers are built for. Computations like these more are used to get confidence that the hardware works.
If it was a shadow ban he would see his site when he searched but we wouldn't. This is definitely not that.
That's a tight subset, and I couldn't even guess what their browsing habits might be.

However I could guess a savvy user has their firewall rules set sufficiently, disallowed a bunch of api scraping sites and may have installed additional safe browsing software. It might even include someone who's just got a good sense when a random link being dropped is bound to be full of nasties. The next question is, would they be spending much time on social media in the first place?
Yeah, it's pretty clear that the first two loans are productive. The third one not so much, and I think that's the original point about asset inflation creeping in at some point.

Though it's obviously a matter of degree and context. If we're really talking about Billies and Charlies here, chances are that the last loan really is beneficial in terms of how it allows capital allocation to change. Perhaps Billie rented out units and just can't continue with that business anymore for some reason, but Charlie can.

If however we're talking about institutional investors or the very rich who will anyway employ somebody else to do the productive work, then the case for the loan is much weaker.
I use adblock to prevent (malicious) ads from running. Browser malicious downloads warnings are enabled. Configured to show a full screen warning if http is used instead of https. Opening links from email requires manually copy pasting, forcing an extra look at links.

Generally I don't install random software outside the official repos or AUR, but I do blindly trust those repos to not be compromised.

That being said, I don't think I could 100% trust a modern computing device to not be compromised, but since that isn't possible I also don't see it as actionable information.
Thank you for making this! I read the book twice last year and it made a deep impact on me and my relationship to basically everything. The book, coupled with coaching has greatly improved my life.

Your site is a great summary reminder of the key points and it brought me back into the experience of reading the book.

For folks reading this, I do recommend reading the book since the website is just a taste of the book. It's lessons may hit different not having gone through the full journey.

Thanks again for making the tribute!
Donald Trump was very much the head of the executive branch in the United States for four years. He may not have written laws but he certainly signed many into law. But, it was broken before he came in and I honestly don't know much about the bills he signed into law.

I would agree with the greater point that might be getting made here is that it's all of Washington, DC gaming the laws and using their democratically elected "for the people" powers for personal inurement.

I will never judge private citizens for using any law to their advantage. After all, a private citizen is just leveraging what everyone else can.

Unfortunately, we know who writes the laws but the voters in states rarely replace their senators and representatives. I wish this was less of a "team sport" where my guy who is "conservative" or "liberal" has to win and people would be willing to fire a senator or a representative for just one term so our elected officials are reminded who they work for and that we may vote them out at any time. We don't have term limits for these seats but through voting we effectively /could/ replace them every cycle if we wanted.

I have a friend who owns businesses. His business is part of a larger non-profit association and this association lobbies capital hill every year. He personally goes up there and has conversations with them once a year for our state. He like to share a story where he was waiting to meet with a member of the house. The representative came out of his office, his assistant was helping him put on his jacket and he asked his assistant "What is this vote for?" .. He gets his answer and then he asks -- "How are we voting?" ... presumably asking how his party is voting or how his majority whip wants him to vote.

I like this verbiage from a specific website (pragmaticvoters.com):

A pragmatic voter understands that a politician who is afraid of losing their position is a politician that is willing to govern for the better interest of the people. Politicians should always fear losing their jobs. Through voting, we remind them who they work for.
QubesOS may be less cumbersome if it works for your use case.
It seems the complicated part of using a computer is not adding numbers together but organisation and preparing an environment for computation.

To run a computation I need code and data to be in the right place. If you analysed the number of add instructions of an average compiled program, I feel we would be surprised how many instructions are actual computations and not copying or moving. I'm excluding address calculations and referring to "add" or "subtract".

Preparing an environment for computation is copying data to the machine and preparing dependencies such as docker, package managers, compilation and other work. It's also moving data between registers in preparation for a calculation. It's similar to a factory processing raw ingredients that need transportation.

How do you represent all this movement and logistics efficiently and untediously? I feel computer science could probably expend some effort on representing logistics efficiently.
Never allow a company or government to install known and unknown software that spies on you. This means Microsoft, Google, Facebook, Apple, etc.
Run Linux. Install only trusted software. Don’t do sketchy (from a security perspective) things like look at porn or use torrent sites on your main computer. Backup often. Reinstall OS annually. Don’t run Windows. Don’t worry too much. Be happy.
How do you deal with leaking of data?
There was a documentary made also, perhaps based on this article?

https://www.justwatch.com/us/movie/happy-happy-joy-joy-the-r...
https://archive.is/FGQhZ
They do, IIRC, but, interestingly, Nvidia doesn't only because they put a RISC V processor on board that keeps it's own blob a few generations back (20xx?). I'm not sure that's actually more open, but I guess if you can run it with all open source drivers and no proprietary blob, that's good?
>This is why Antiviruses are totally useless

Not all attacks are targeted and AV can detect abnormal behaviour. Regardless, having the operating system do proper sandboxing is much more valuable than trying to fix it after the fact with AV.
>> expected most RISC-V boards are going to be open hardware, but maybe I was wrong to assume that, heh

There aren't any/many GPUs they could use with open source drivers are there?

I'd like to see one with a bunch of small RISV-V cores running llvmpipe as a GPU, but it's not clear how good that would be.
‘Wings like cracked eggshells’–Branson's turbulence over safety of space flights
I have not debugged it much, suspect hw as I tried a few sw things without success. But could be sw fix. Anyway I'll make a new revision, this current one is a bit limiting due to the MCU and one minor hw bug that needs manual rework of the pcbs.
Even worse was one of mine last year that needed Flash. Apparently we neglected to update it. I can handle ancient Java, but trying to get Flash setup was going to be futile, so I just went to the data center.
Can You Trust Your Computer?
https://www.gnu.org/philosophy/can-you-trust.en.html

Eben Moglen: The alternate net we need, and how we can build it ourselves:

https://www.youtube.com/watch?v=gORNmfpD0ak&t=2s
Next time just use jsonApi and forget your worries :)
I'm looking at current options, this[1] for example is packaged for Fedora, which is my daily driver.

But then I got to thinking, if I'm going to do a clean Fedora install for the tripwire (it's best practice) I might as well try Fedora Silverblue[2]. Silverblue is an immutable system so it kinda makes a tripwire less useful because no one can change any system files. Only files in your home directory and /etc can be modified statefully.

1. https://github.com/Tripwire/tripwire-open-source/

2. https://silverblue.fedoraproject.org/
You’re not a programmer, you’re a hacker
ex-AOSP dev here

Android and ChromiumOS are likely the most trustable computing platforms out there; doubly so for Android running on Pixels. If you don't prefer the ROM Google ships with, you can flash GrapheneOS or CalyxOS and relock the bootloader.

Pixels have several protections in place:

- Hardware root of trust: This is the anchor on which the entire TCB (trusted computing base) is built.

- Cryptographic verification (verified boot) of all the bootloaders (IPL, SPL), the kernels (Linux and LittleKernel), and the device tree.

- Integrity verification (dm-verity) of the contents of the ROM (/system partition which contains privileged OEM software).

- File-based Encryption (fscrypt) of user data (/data partition where installed apps and data go) and adopted external storage (/sdcard); decrypted only with user credentials.

- Running blobs traditionally run in higher exception levels (like ARM EL2) in a restricted, mutually untrusted VM.

- Continued modularization of core ROM components so that they could be updated just like any other Android app, ie without having to update the entire OS.

- Heavily sandboxed userspace, where each app has very limited view of the rest of the system, typically gated by Android-enforced permissions, seccomp filters, selinux policies, posix ACLs, and linux capabilities.

- Private Compute Core for PII (personally identifiable information) workloads. And Trusty Execution Environment for high-trust workloads.

This is not to say Android is without exploits, but it seems it is most further ahead of the mainstream OSes. This is not a particularly high bar because of closed-source firmware and baseband, but this ties in generally with the need to trust the hardware vendors themselves (see point #1).
On MacOS, poke the TouchID key to Lock Screen. When back, poke it again to unlock. Make this rote.

On Windows, Win-L to lock.
Guccifer Speaks Out After Nearly a Decade Behind Bars
Delivery app Hugo crushed Uber in El Salvador. So why is it shutting down?
I work from home and still lock my screen because I have cats that will walk on my desk if I'm not looking. 4 paws and an open vim or slack window are a dangerous combination!
https://www.lifewire.com/ubiquiti-promised-premium-secure-ro... [2021]
I still think you're being way too general here by deploying hyperbole like "technical superiority" or "surpass" to subjects that are just about aesthetics. Adapting it to your frame here, my point was something to the effect of: if kqueues were clearly superior technically, then applications[1] which rely heavily on widely-multiplexed kernel notifications would naturally have migrated to the superior solution. (Ditto for zfs/btrfs, etc...)

And... there really are none. For all the yelling, in fact epoll works great. It still works great. Claiming something is "technically superior" to a product that clearly works great in the market is a red flag that you're probably not arguing about technology.

[1] Which are MANY! The whole cloud runs on epoll!
I made a very simple pcb breakout board before, but I don't really count that, so the first that's not very basic.
Study Moves Therapeutic Use of MDMA Toward Approval
https://byorgey.wordpress.com/2009/01/12/abstraction-intuiti...

well, it’s so simple: they’re just burritos!
What would be an example filetree structure for the nix run to match #!-interpreter via flake? Cannot all the definitions fit into a single "flake.nix"? Also, would it be possible to use some other name than "flake.nix"?
I only have limited trust. Between 3D printing slicers from Chinese companies, many packages from PyPI and Rust crates, there is always a danger that something is compromised somewhere.

I try to limit attack surface in the following ways:

- I only use M1 Macs as desktops. This reduces attack service in various ways. M1 Macs do not have anything like UEFI firmware, it all starts from the iBoot ROM and the whole chain is verified with signatures. The OS is on a sealed system Volume that is read-only and signed. Altogether, this limit firmware/OS attacks.

- I use a U2F key and/or the Secure Enclave of the Mac for credentials (SSH keys, 2FA). They are set up to require user confirmation.

- When possible, I will install applications from the Mac App Store, since they are sandboxed by default.

- I use separate work and private Macs.

- I clean and factory restore my Macs every few months.

- I use some tools like Knock Knock to see if there is anything suspicious.

Compromise is obviously possible, but I try to push it into 'mostly state actor' territory, because I am not interesting to most state actors.
Another new and interesting corner case for tesla autopilot engineers to agonize over.
Looks like MacOS

Malicious files to search for and remove:

/private/tmp/.svx856.log
/private/tmp/.ptslog
PTX-Player.dmg (SHA256: 8913e38592228adc067d82f66c150d87004ec946e579d4a00c53b61444ff35bf)
PTX.app
Python probably has one of the higher percentages of monolingual developers (perhaps only JavaScript is higher?)
Looks like MacOS
Are you talking about normal sites? Not search engines? If so I don't really agree. I don't think you have to go through that much effort as part of implementing a shadow ban. If posts show up to the user in most places, then good enough it's a shadow ban.

Only because this is a search engine do I say this solidly isn't a shadow ban.
I'm found of seeing the Fourier transform as a fancy way of changing basis / coordinates, not sure how mathematically correct is that.

In high school physics some problems got way easier by redefining coordinates as x' and y', solving for those, them going back to x and y. That's what the Fourier transform does, but for functions.

Looking at its formula, we can see it looks like we are projecting a function into a series of complex exponentials, just like we need to project a vector in x' and y' for a change of basis in the euclidian space.

Then, the Fourier coefficients can be thought as "how much my function looks like a complex exponential of this given frequency". Compare the formulas for the Pearson Correlation and Convolution, they are almost the same.

Since the Fourier transform is just a particular case of changing basis, there are many, many other integral transforms that might be useful in different contexts. We can even create our own. But unis teach about the Fourier transform because it is really good for solving differential equations, which turns out to be a popular way of modeling problems in engineering.
I used to work on the Hill. This is bullshit. Lobbyist input is taken into account, but "writing an entire law" is more of an exception to the rule.

What's with the conspiratorial cynicism of the American political system on this board?

@Dang - most of the commentators are also new to HN. I feel like I've brought up this issue before.

edit: removing unconstructive snark from post
I dont! In fact I assume it has been to some extent and that I would be unable to detect this.

Going from that assumption, I take care to keep encrypted backups of all of my important files both locally on another machine and remotely.

I also use two-factor authentication wherever possible, because I find it unlikely that the same attacker would gain access to both my PC and phone.

Additionally, I have a second phone with no SIM card that I use for some TOTP 2 factor accounts that I wish to remain especially secure.

Operating at the assumption that you have already been compromised allows you to prepare for the worst should you truly be.
Could call it a RoboBlock in popular language, with reference to a roadblock. An obstruction to engage enforced by our machine overlords. Or better maybe, a RoboGag.
When you first hear a term used, I think it's natural for people just try to figure out what it means in context without looking up the official definition (I've caught myself doing this subconsciously before).

Imo a logical interpretation of "shadow ban" would be when you are banned but they didn't tell you they banned you, and regular "ban" is when they tell you you were banned. It makes enough sense that people don't think they need to look it up to confirm.

edit: funny enough, I did double-check the wikipedia page to make sure my understanding was correct, but upon reading further it does acknowledge the expanding of the definition: https://en.wikipedia.org/wiki/Shadow_banning
Yep, this is why discussing this issue can be a hilarious exercise in circular frustration. The counter argument boils down to "don't hate the player, hate the game", except these players are lobbying to keep the game alive, so don't tell me I can't hate those players.
I don't know, really. I have a ton of "personal machines" when it gets right down to it, but I'll think client wise.

I distro hop chronically on most of my machines. Sometimes multiple OS reinstalls across machines per week. Some installs have lasted a few months but it's rare.

I try to stick to official repos when I do reinstall, so I'm outsourcing that trust to the distro maintainers.

If it's on the disk, it's gone except for a few important files I keep in a self-hosted Nextcloud sync folder.

I use LUKS encryption to ensure leaving the laptop on the bus is a non-event. If it was ever in somebody's possession for very long (border, police, lost and found) I'd just put it in the garage and never touch it again.

Firmware malware is pretty uncommon, still, so I'm just hoping for the best there.
I've had multiple time to factory reset Dell iDrac when some commands where failing with never seen before internal errors. Thankfully you can factory reset but keep network config, so no need for physical access.
duckduckgo is a joke. use gibiru