skysight-inc/HackerNews huggingface dataset:
> mighty-snitch (lsm based, with pid info)

I noticed this is pretty new and a couple things caught my attention

> the primary advantage is that it has direct access to the pid, executable, and commandline of the process making the request.

Does this mean it is guaranteed to be able to open a copy of the executable no matter how short lived it is? This was quite a challenge for me when trying to grab it in time for hashing. I ended up settling on simply opening /proc/pid/exe as early as possible, marking it with fanotify, then putting it in a queue to read later and reporting it if it was modified before being read.

> the systems fails closed. when snitch isn't running, network requests are not possible.

This is a pretty impressive feature which I haven't seen elsewhere. I'm not familiar enough with lsm to know what's possible and I see you use a custom kernel. What sort of guarantees does this provide and have you come across any limitations?
Keeping a complete log of all GET requests to random files in a public repository in a reliable way would be insane.
This isn't an argument that no actual wolf is present, just a reminder that others have cried wolf before.

>> And of course parental rights, adults are not affected

Adults are subject to age verification including the connection of their ID to their social media profile. Facebook thinks I'm 118, and when I get ads for hearing aids on news sites it's illuminating. I will never send my ID to Meta, Twitter, or any other similar company — which means I will simply be shut out of that realm of discussion.

If parents want to limit their kids' exposure social media (and I very much do), it's on them to manage. If the government has a case of "think of the kids" and wants to regulate something, might I suggest something further up the "what actually kills kids" list, like enormous lifted trucks & SUVs?
Would this work?

https://github.com/queer/boxxy

[Edit] woops, I didn't notice that it is linked right at the bottom.
We can try to abolish police.
Yeah, I was thinking that Afroman has nothing to do with sullying whatever reputation they think they had. Afroman just filmed them doing it.
Would these secure storage methods for the key be able to scale up to the ssh connection volume an outfit like GH sees? Genuinely asking; I don't know the answer. I just feel like having to hit a HSM or something similar every time a new ssh connection comes in wouldn't work. Or at the very least I would not see the sub-100ms connection time I can get right now.
I was under the impression that most high value content producers and moderation tools that make the bigger subs usable rely on old. They know they'll drive away all the power users if it goes.
As a German, I used to think the same back when Wirecard was first attacked - and look where that ended.

Right now, the financial system is extremely unstable - bad actors with an awful lot of exposure have been exposed, and a lot of people are like sharks in the water, smelling blood. It looks like we're due for another come-to-Jesus moment in the banking scene, they haven't learned enough from 2008.
Norway's economy is 7x that of Serbia (from Wolfram Alpha) and the Nordics do invest in this sort of thing.
> But when one says that GPT is "just a statistical model" they're implying a capacity cap of statistical models

Except there is no “capacity cap” on statistical models, we have no idea what they are or are not capable of yet.
The answer already exists but people refuse to implement it.
the license wouldn't be that important if say it was just covering over a vercel specific API. that's not the case here, but the license would be irrelevant if it's just talking to a vendor locked service.
For somebody from another country this sounds insane..
thank you! just surprised it's not right there as a spec on the page for the 16" which clearly would be for power users. So many laptops max out at 32g or even 16g.
Thanks for ordering our air quality monitoring kit!

We use the same industry grade sensor modules that are normally in much more expensive commercial monitors. So the kit will give you very good accuracy.
If you contemplate all the possible reasons why you might smell like pee, you will have your answer.
> I'm not sure if there are physical limitations preventing a room temp superconductor.

Not really. We just know that it’s very uncommon at best. The limit is material dependent and we already have superconductors with more than one order of magnitude difference in their critical temperature (e.g. ~4 K vs ~40 K; YBCO, which is widely studied, is at 90 K). It is not inconceivable that we could come up with some fancy material with a critical temperature three times as high again. There are several laboratories with good money working on it.
They do like to try :(
I have seen attacks along the lines I just outlined and well beyond in my industry many times.

A wildcard TLS cert or an SSH host key in plaintext is a loaded weapon laying around and it will be used on a high value target.

Sad fact is most of the companies that hold billions of dollars of customer assets do development exactly the same way a gaming company might. Those that even attempt security are unicorns. They bank everything on things like DNS, BGP, TLS certs, and ssh host keys working. This is like the medical industry before they learned hand washing was a thing.

I teach every one of my clients how to do things like commit signing, but for every one I help improve there are 100 more on track to be hacked any day now.

I can totally forgive a startup that cannot afford senior security engineers for a mistake like this, but Microsoft can afford that, or at least consultants, and yet they can not even enable optional signing for NPM, properly enforce git commit signing, or even protect an ssh host key trusted by millions in a TEE or HSM.
https://github.com/b3nj5m1n/xdg-ninja

This utility has been a lifesaver to clean up my home directory.
They don’t need it. Millions of users are going to blindly trust the “new” GitHub public SSH key they see the next time they connect without checking to see if it matches the published signature.
By pretending to be the host that the user is trying to connect to. You can then present the client with a key you generated yourself. Of course, SSH will warn the user that the fingerprint has changed, but they'll just think "Ah yes, GitHub changed their keys so it's probably fine." This is why updating the key creates a potential MITM risk, unless people actually bother to verify that the fingerprint is correct.
I would never say this in the Balkans but maybe take a look at Croatian/Bosnian resources as well.

Nobody wants to admit it but it is basically the same language, heck was called Serbo-Croatian a few decades ago.
I want Prolog plugin with triplets database
$25 for an Airtag, plus say $20 for a smart switch. Plus $200 for a HomePod.

To turn a single lamp on/off by pointing at it, something that nobody ever wants to do (alright, once for the cool factor). If someone wanted to overpay for useless features, they can already go for a Philips Hue.

I can turn off my lamps from anywhere in the world using a $10 Tuta ZigBee bridge and a $8 LIDL light.
Amazing AI by Sindre Sorhus uses Apples port of Stable Diffusion to the neural engine.

https://sindresorhus.com/amazing-ai
Logging at Zerodha
I put it in another comment, but if you are Rusting on Linux, you can use boxxy to fix bad behaving applications.

https://github.com/queer/boxxy
I don't think so.

When I go to a bank here in Switzerland as a Swiss and ask to open a bank account I am asked if I have an US Citizenship. I am not asked if I have a Russian or Chinese or any other Citizenship. Why is this? Because the US has forced regulations down Switzerland throat with threats of preventing Swiss banks from using the USD.

In many other European countries there are US soldiers stationed. How many French or British military bases are there in the US?
Actually I am not seeing the fingerprint they announce in the blogpost

When I tried to pull from my repo I got the warning message, right

I removed the old keys with ssh-keygen -R github.com

Then, trying with `ssh -T git@github.comp` I see this

The authenticity of host 'github.com (140.82.121.3)' can't be established.
ECDSA key fingerprint is SHA256:p2QAMXNIC1TJYWeIOttrVc98/R1BUFWu3/LiyKgUfQM.

So, first thing of course, is that the fingerprint does not match the one in the blogpost which is
SHA256:uNiVztksCsDhcc0u9e8BujQXVUpKZIDTMczCvj3tD2s

Second problem, is that ip 140.82.121.3 seems to be reported as HIGH RISK[0]

So basically, how should I proceed? I am not security expert but I would say I am not an illiterate on this, and I have no idea. I guess the majority of users would you accept the new key, but is this the right move? I would need to do it if I want to do some work, that is for sure

EDIT: Formatting

[0]https://www.ipqualityscore.com/free-ip-lookup-proxy-vpn-test...
if you run a MITM attack today the victim gets the warning in the blog post. Thier most likly action is to google the blog post and see it is expected and and so accept your fake key.
Having said that I dont see what choice Github had, they can't continue to use a leeked key.
Not directly related, but SSH certificates are one of the most underutilized features of SSH.
> Dorsey is a big Bitcoin fan, so that’s the kind of utility he appreciates.

This sounds disingenuous. Not every fan of Bitcoin supports fraud, drug trafficking.. etc. The dollar is used for such bad activities, should we label everyone that loves the dollar as a supporter of fraud and drugs?
Here I’ll do the CBA:

- if they have evidence that the key was exposed to one person, even with zero usage of the key, failing to rotate the key is tantamount to knowingly accepting widespread compromise at a potential attacker’s whim. At GitHub’s scale, that’s untenable.

- rotating the key is the only correct reaction to that

- they should have better communications in place to help users mitigate MITM

- there really isn’t an option, because they’re critical infrastructure; I’m glad they know that and acted accordingly

- on principle this speculation makes sense, but understanding the threat makes it moot

- you hopefully know that, and it’s good to insist on thoughtful security practices but it’s important to also understand the actual risk
The black box could well be a local library. Functionally, what would be the difference between using something like AIKit and using a REST API over the network?

Local has a lot of advantages as well (latency, privacy, etc).
Why am I hearing "Tony Stark was able to build this in a cave", dialogue in Google board meetings?
It only failed, because of AMD being allowed to come up with AMD64.

If x86 was Intel only, Itanium would have been eventually pushed everywhere no matter what.
In my experience a Proof of Concept is king but even then there is a balance to strike.

A PoC that is too rough around the edges has the risk that less imaginative people will not get it.

But a PoC that is too polished risks being confused with an end product and people may start to focus on implementation details rather than the concept.
It's important on any system, not just XDG. The OS will assume you do, and offer features based on it, such as cleaning cache dirs, emptying temp dirs, etc.

It's not just about being tidy, although it's important.

But remembering all that stuff is annoying.

If you use Python, the wonderful "appdirs" package will make using the best dir for the job on Windows, Mac and Linux, easy and transparent: https://pypi.org/project/appdirs/

I wish it was part of the stdlib.

Another thing that grind my gears is people putting files inside their code project folder for development.

It should be something configurable, that by default use the OS dir for prod, and "../var" dir with everything on it in dev.

Less gitignore trouble, let's watcher overhead, less indexing for nothing, less clutter in file explorers, less possibility for errors.

But you need to provide an easy way to locate those files, such as a cmd line entrypoints, otherwise it's painful.
A freshly poured concrete structure with poor ventilation can go well below 400ppm.
https://github.com/sagiegurari/cargo-make is also a good (and simple) solution for the requirements in the post
Probably a hallucination.
Thanks for the suggestion! I think in that case I'd probably want it to automatically combine certain adjacent words into phrases, which is definitely doable with AI but could be expensive to do for an entire text vs just paying for the words and phrases you click to translate like it does at the moment. Also, newsinslowspanish only turns some of the content into links - it makes an assumption as to which words you'll know and which ones you won't, which may not be valid. If you turned the entire text into their style of hoverable links it could look cluttered. You'd want more subtle ones. In fact, it would be very much like Duolingo Stories, which does work well! I'll think about this.
That's the point - globally all air now contains above 400ppm, it's the great tragedy of climate change. You can only see less than 400ppm if you put the sensor in an airtight container and add something that absorbs CO2 to it - then the value will go below 400ppm. But because that's not how most people use these sensors, they are calibrated for 400ppm upwards.
The fact that users have to delete the old Github key from their systems and accept a new one is what could lead to a MITM attack.

If your system doesn't know the public key of an SSH server, when you connect the first time, the SSH client will display a warning and ask you if you accept the server key. An attacker could be between you and Github and if you accept without checking it's the correct key, you would be toast.
If you own your home, you could install a ventilation system with an air-to-air heat exchanger with the outside... that way you at least reduce the heating loss. Or you install a forced ventilation towards whatever adjacent room there is, with a foam mesh to pad down on sounds.
I would hope not: https://www.co2.earth/
Also being discussed at https://news.ycombinator.com/item?id=35284187
Yeah, I've never been happy with the fact Signal requires phone numbers as an ID. Beyond the privacy issues, there's also issues that I've encountered when someone used Signal (on iOS) and then stopped using it. Once they stopped using it, others who were still using Signal weren't able to message that person anymore outside of group messages. Honestly, the whole thing is a mess. Thank you.
Sure, so like I said, you have a situation where a CO2 scrubber(in that case concrete) is present. If you need accurate measurement of CO2 below 400ppm and not just "it's less than 400ppm" then you need to buy a different sensor.
The dark ages (Hidden Assumptions)
Ha. About 30 minutes ago I was trying to figure out if I was being MITMd and decided to manually update known_hosts to list all public keys published in GitHub's docs. At least I know what happened now.
For now it provides the whole sentence that the word was in for context. It works pretty well but I'm sure it would be better if I gave it a little more. 2 or 3 sentences would probably be great, but obviously more expensive to run.
One could argue that maturity can only be reached by allowing minors responsibility
Epic just released the Unreal 5 dev tools for Fortnite, allowing for modding with the Verse functional programming language.

Their monetization strategy looks interesting to say the least.

https://www.epicgames.com/site/en-US/news/introducing-unreal...

Modders receive 40% of all profits Epic makes through Fortnite, distributed proportional to mod popularity, and artists selling assets through the store receive 88% of their profits. All this seems very generous, and is no doubt Epic trying to compete with Roblox to create a "metaverse" of sorts.

Considering how easy relying on an existing engine with existing assets with a simple functional language would make game development, is this overall a good thing for the game development community? Or is Epic trying to get everyone to adopt their platform so they can have ever increasing amounts of control an iffy thing in the long run?
> How long was it visible for? And no, "briefly" doesn't cut it.

I don't know how long exactly, but in theory you can subscribe to a stream of ALL events happening at GitHub by fetching from this endpoint: https://api.github.com/events

With these events you know what new repositories are created and what changes are pushed, so you can fetch every new change. Once something gets pushed to a public repository, it's very likely that some spider will have fetched it within a few minutes.
Hilarious. These super tough dudes with their guns and military style badass moves. And now they sue for emotional distress.
Because they're carnivores. Mammals evolved in the Jurassic as nighttime creatures, because warm blood gave them an advantage over reptiles, and they lost color vision in exchange for better nighttime vision. Once dinosaurs disappeared mammals no longer had to restrict themselves and could occupy new niches. That's when primates got color vision back, to be able to distinguish ripe fruits.
That depends on your standard which is necessarily subjective. By some reasonable standards, a lot of things you consume has not had a formal study proving safety. For example, I'm not aware of studies proving the safety of lettuce, tomatoes, cucumbers, etc. No, history/"common sense" is not a replacement for a controlled/experimental double-blind study.
You’re looking at the fingerprint of the ECDSA key; only the RSA key was replaced (and only the new RSA key’s fingerprint is in the blogpost). Check https://docs.github.com/en/authentication/keeping-your-accou... for the full list: the key you’re seeing is listed, so you should be fine.
Getting close to 5k yeah. The average over the preceeding year was around 4k.
I'd like to believe that there's already a sort of balance in place created by the fact that with enough evidence of someone doing something really really wrong, even if that evidence couldn't be used in a court room, that can still be presented to the public who will use that information to reach something approaching justice.

I'd like to think that if someone, especially someone in a position of power, were caught doing something truly evil that society would find an appropriate response regardless of some legal technicality and that there will always be someone willing to risk the personal legal consequences for letting the rest of us know about it. That that same risk of legal consequences would also prevent people from exposing others over trivial matters.

I'm not sure that works out in reality though. We have lots of evidence of people who have done very terrible things but have fully gotten away with it, and plenty of evidence that society is as terrible at evaluating evidence as mobs are at coming up with just responses.
How Twitch Lost Its Way
>make a column in the DB to no longer allow NULL values, and we are immediately notified by the TypeScript

Can you elaborate on this? Is this using something like knex/objection or something else?

Is there something that will do this if one is using mostly raw sql with knex?
No, it wouldn’t be - assuming by “insane” you mean “silly to do”. I build systems at Google that do exactly that.

Whether it’s worth the cost is a decision each company makes. Also, you don’t need to keep the log forever. Max of a few weeks retention would be common.
You could do one better with SDR units and use trilateration of police radios/radar to track them in real-time.
They get trained by state institutions usually but the program in my state is sixteen weeks. For reference, a lot of work in Afghanistan is more policing than war fighting and we trained for a year plus. The issues around policing are somewhat complex city to city. For instance, my city is fairly large and has ~300 cops and calls that aren't actively violent typically go unanswered and crimes go unprosecuted for a litany of reasons. No matter what city you go to, it's near ubiquitous that there is some kind of major problem with policing. I say policing in the context of the DA + police.
p2Q is there https://docs.github.com/en/authentication/keeping-your-accou...

Not in the blog post but the blog post points to my link which is the official documentation.
I would be interested in the percentage of

1. Bitcoin (crypto) users who (only) have BC because they hate fiat money

2. Users who have BC because they need it for illegal gains

3. Opportunistic investors

4. Web3ers

I have the unsubstantiated feeling that 1 is overstated.
Try adding all the keys shown in the docs here to your known_hosts.

1. https://docs.github.com/en/authentication/keeping-your-accou...
Non-paywalled link in case that's a thing for some geographies https://archive.is/HcgWz
@dang Should probably be merged with https://news.ycombinator.com/item?id=35276784
The key has changed, meaning that every user has to accept a new key.

Meaning that a lot of users will blindly accept whatever new key (even when it might be the one owened by attacker doing MITM) because Github, their college or random person on internet said that that's what you have to do to get rid of error.
Leaking something like a private key? You do that once, then you learn. If you don't learn, you remain a rookie. Or just reckless.
They moved slower, yes.
The HSM only needs to sign new host keys, transactions per decade at thier current rate.
Bad example for your argument, as these magazines constantly break the law by outright lying and publishing fabricated news stories.

It's pretty much their business model to publish fake news. While they'll have to redact the articles later, they've already made their money by that time.

While I can't speak for the legality of using photographs from people for profit without their consent, I'm sure that the magazines would still do it, even if it wasn't legal using the same tactics.