skysight-inc/HackerNews huggingface dataset:
It's comforting to imagine applying some justice to these gangs of violent home invaders, but as the second degree murder of Breonna Taylor demonstrated, adding self defense to the equation just makes the bastards feel that their shooting sprees are even more justified. Like sure I can imagine some kind of home defense product that uses a camera and robotic gun to dispense justice in the event of a home invasion, but really we just need to get back to having the rule of law in this country (where the violent home invaders go to jail with the other bad people) rather than thinking that becoming more adversarial creates a meaningful check.
> Every decade or so we come across an algorithm that takes a problem from the NP domain to the P domain

Wish they’d given/linked a few examples there, anyone happen to know some off the top of their head?
Conveniently missing from the announcement:

- When exactly was the key leaked? Yesterday? A month ago?

- How long was it visible for? And no, "briefly" doesn't cut it.

- Did any internet traffic reach the page while it was exposed? We know you log everything, so it is a yes or no answer.

If any of these answers were pretty, I imagine they would have explicitly included them in the post.
Not playing devil’s advocate but guess they at least have some confidence that no one checked out/pulled the repo while the key was there?

After all it’s them hosting and serving the requests for that (and every other) repo.
What is the job of US soldiers in Syria?

Finding reasons for war?

https://www.aljazeera.com/news/2023/3/24/us-says-air-strikes...
So the consensus is that consciousness is computable by a Turing machine?
Interesting. To save anyone else looking it up, Ctrl+Enter in Chrome, Firefox and Safari (at least) is "Add www. and .com to a site name, and open it in the current tab".
I don't think we can even assume that all languages have a common origin though. Maybe that is not the case.
This sounds great, but why can’t Siri still not understand me.

Maybe Apple has the ultimate
> That's the only possible course of action.

Only _reasonable_ course of action. Possible is to do nothing =)
This is... formidable. He has an impressive body of work and to have been doing it every day since 2011 puts him only a few years behind Beeple's Everydays.
I had a daily collage project similar to this but it was 100% automated. I gave up on it after a few months of zero hits.
It never fails to amaze me how most incident mitigations seem completely oblivious to such security side effects.

"We have no reason to believe that the exposed key was abused, but out of an abundance of caution, we are going to expose 50 million users to a potential MITM attack unless they are extremely careful."

Not a single word in the post about whether this impact was even considered when making the decision to update the key. Just swap the key, and fuck the consequences. Same with the mass password resets after a compromise that some services have done in the past years. Each of those is any phishing operation's dream come true.
if you're using mobile firefox, i think the redirect doesn't happen from i.reddit.com (not yet anyway?).
Framework should beg Sensel for a blank touch surface...which you could press a couple of macro keys to entirely transform the surface with.
users print out a custom layout to guide their fingers.../dream
The kinds of programs that were putting in entirely nonstandard paths (~/app.config), or paths specific to macOS or Windows, are still doing that.

But when it comes to a 'well-behaved' Unix program, there used to be one place to look for its configuration, and now there are three.

That is, a program foo could still have its configuration in ~/.foo, but now it can also have it in ~/.config/foo or ~/.local/share/foo. If I don't know where the configuration is already, I have to check all of them.

I know ~/.local/share is supposed to be for "data files" and ~/.config is supposed to be for "configuration files", but in practice the distinction seems to be rather unclear.

Also, ~/.local/share/foo is a lot slower to type than ~/.foo even with tab completion. Why does that path need to be two directories deep? ~/.config/foo is less bad but still slower.
Oh. I guess this is why the ops guys at work prefer GitLab. (And honestly, GitLab has gotten MUCH better over the last couple years.)
> But what it sounds like you want is an E-core mad part from Intel. I always thought they should sell a 20-30 core laptop part with only one or two big cores as a compilation monster.

Indeed. I've been looking at the 12th gen laptops we're getting at work, but those were underwhelming. I don't remember which model CPU it was, but it only had 2 P cores (those are basically for "office work", so no one cares about performance). For compilation (Rust) it was in the same ballpark as my 11th gen i7 (so 4 "regular" cores + HT). For basic day-to-day work, they both felt the same.

As you say, I'd expect a part with more P cores to be interesting for my use case, which is exactly the same as your sibling's [0]

[0] https://news.ycombinator.com/threads?id=vladvasiliu#35280246
Michael Jackson never learned to read or write sheet music.
How is there an alternative here?
Correct, the colors are not part of the tiling. They showi some additional structure which is used in the proofs of aperiodicity (and tiling). That said, the coloring is chosen in relation to the dark blue tiles, which are reflected relative to all other tiles.
OpenBSD does (did?) require all syscalls to originate from libc as well.
If damaging outcome to our youth is your main concern we might want to start by censoring social media altogether. And alcohol, and not doing any sports, and eating fastfood, and being overweight…

But back to religion, I think religion opens the doors to a society that accepts lies as facts. It basically legalizes stating assumptions for facts, and making those assumptions have big impact on society. And thereby it states that it’s ok to do that on a larger scale, the way you see fox media spewing lies as facts, and how the way Trump talks is ok.
What’s your limiting principle here? Should schools also carry old Playboy magazines? They’re less sexually explicit than drawings of two underage kids blowing each other. Are the straight kids not horny? Should there also be straight porn in schools?

You can’t just drop sexually explicit images in a book then cry afoul when parents and taxpayers don’t want it in their public schools. They didn’t allow hustler and playboy and they’re trying to not allow this. They have a pretty consistent standard unlike the groups that advocate for such material to be made available to kids and teens.
> Maybe Google could benefit from having you train customer service for a few days ;)

Customer service? What customer service? :P

> That said, couldn't an exploit simply turn off security updates?

Sure, but I was thinking more along the lines of if you have a widespread issue then people will write about it and how to restart the device to clear the infection, turn off remotely exploitable surface area, etc. For example I know a lot of people would turn off iMessage when the effective power stuff was going on since it was so easy to exploit and used widely to troll.

> Why wouldn't this have been a goldrush to exploit by unsophisticated attackers? Maybe I'm missing something?

Right, this isn’t an 0-day anymore, because Google knows about it. Some of the bugs also have patches available, making those effectively public. Apparently, some are not fixed yet and also easy to exploit, for which Project Zero has made a rare exception for and not disclosed.

In general, if an exploit remains unpatched for a while, it will actually start being exploited by opportunistic attackers. Some exploits are actually really easy to launch, because they are simple or someone left a PoC online. Those can and do get spammed en masse by things like ad networks and generic malware.

For more complex exploits, or partial patches, you’ll often need a sophisticated attacker to actually design the exploit once the bug is known. Those ones are not generally in the business of hacking a million people and trying to get their credit card information. Top vulnerability developers are frighteningly fast in how quickly they can make a working exploit out of a patch that they diffed to my knowledge it’s more reliably lucrative and safer for them to sell it to people who use them for targeted attacks, so that’s what they do.

Anyways, here I suspect the answer is “the ones that are public are hard to exploit” and “the ones that are not public might actually be dangerous and were withheld for exactly that reason”.
No. This is not a corner reflector. Read the wikipedia reference I posted.
Well this is certainly going to break quit a few CI/builds/systems that didn't account for this.
> aka the brainwashed AI that reinforces their political and cultural biases

I love seeing IronyAI called out like this.
I like these small, single purpose, C libraries. Is there a maintained list of these somewhere?
Imagine the amount of ssh connections that github must handle every second, I don't think it's so easy to hold the private key in a HSM while maintaining the necessary performance and availability.
https://muted.io/
As an mere user this is what I had assumed. Siri has been stagnant and buggy for years; it makes sense they are working on a big replacement instead of putting resource into incremntal improvements on what seems to be a weak foundation.
Right but that’s exactly my point: you can’t patch the vulnerability yourself because you don’t know what it is, and the alternative of disabling radios is debilitating and you can do that in software too, since this isn’t a bug in that switch itself.
Not only is this a problem with everyone, it's also one of the "soft" skills you learn to deal with in school. It occurs in professional and social interactions as well and school prepares for dealing with it.
Privately, sure. I don't think admitting it out loud makes better people.
There isn't an alternative, really. The private key has been exposed, and presumably it is unknown if or how far it has spread. The SSH keys must be changed, and the sooner the better. All that can be done is to notify people after the change has occurred.
This is why I think it's possible to have an "information advantage", even when the information is publicly available to everyone ... which in reality just means, it's an understanding advantage of the public information.
There is a changed version that includes drop-in config files, masking, and loading defaults from /usr/ instead of requiring full config files to live under /etc:
https://uapi-group.org/specifications/specs/base_directory_s...
Yes, by the time iphones can smoothly run llama 30G, the state of the art gpt-x will probably be a terabyte. Skynet will forever live in the cloud with just assistant agents living on the devices.
Interesting. I have chronic allergies and narrow nasal cavities, but my sense of smell is very sharp. In fact I smell a lot of things I really don’t want to just about every day.

I can smell my family members across rooms, smell dog poo that wasn’t picked up on the sidewalk long before I walk close to it, smell fumes from traffic very easily.

Allergies dampen it but I can smell more than I need to all the time.

There’s one weird part though. I can’t seem to smell pee very well. When my kids were smaller and would get pee on stuff I’d never notice. Clothing, bedding, etc. To this day I have no idea why I can smell someone’s dirty hands from several feet away but I can’t smell pee. Everyone can smell pee, I think.

As a result I always assume I probably smell like pee but have no way of knowing.
What were the implications of this? Could anyone with that key have cloned any GitHub repo, private or not?
Loading it from HSM to memory/keychain is probably fine too. It's certainly odd it found its way to a repo and makes you wonder how that could have even possibly happened. And what that indicates about their security practices in general.

Github is host to a large percent of US tech IP. Pretty concerning if you extrapolate.
I’m using Pianote.com to learn Piano on my own and I love it. Bite sized lessons slowly building up skill and theory at the same time.
I wonder how we determined that porn is bad for children. Were there any studies done on the subject? What would I need to google for to find them?
So microwave dinners are not only traditional, but even post-traditional now, where one's grandparents may consider them traditional but one oneself may not eat them?
Show HN: LiveQuery GPT-4 – Chatbot with Real-Time Search
I'd like to share ChatGPT-Live, a project I built to extend the capabilities of GPT-4 (or GPT-3.5 turbo) by allowing it to access live data from the Internet. Leveraging the power of LangChain's Conversational ReAct technology and the simplicity of the Gradio interface, the implementation is dead simple.

While the recent announcement of the ChatGPT plugin definitely reduced the need for this specific use case, I hope ChatGPT-Live serves as an example to show case the versatility of LangChain and demonstrates how easy it is to build generative AI applications. I hope you guys still finds it valuable in a certain way and I'm eager to hear your thoughts and feedback!
Universal Summarizer by Kagi – Summarize any content on the web
> > Some states already require two party consent for recordings. Ohio isn’t one of them.

> That pertains to audio, not anyone’s image.

Approximately the same states are all-party consent for video recording any place that there is a reasonable expectation of privacy. However, reasonable expectation of privacy is different between audio of a conversation, and video.
You never been on bart?
Is it a rookie mistake though? It happens to everyone in my experience.
Chicken does not belong on pizza.
also no updates since then.
does any library follow this reference implementation?
llama.cpp surely is more optimized?
I don't doubt that. But the point is that this is an extremely terrible implementation of whatever it is they are trying to achieve.

I've jumped through the obvious hoops of disabling sleep and automatic update installs. If I put my PC to sleep, I want it to stay asleep, I don't want the OS to second-guess me, especially if it's unable to plan for its own configuration that may prevent it from doing what it's doing.

To me, this just reeks of a half-assed attempt at copying apple's "power nap" feature. "Yah, let met check your mail while the pc sleeps (who the hell cares?!) or apply random updates". Except that on macOS, you can disable this with an obvious checkbox in an obvious place. Having to sift through event viewer (which for some reason is unbearably slow even on an 8-core Xeon with an NVMe drive) and going spelunking in the registry looking for undocumented settings is so user hostile.
I'm not American, so maybe there's something I don't know about here... but cops sue for "invasion of privacy" for being filmed?

Aren't they persons in public practice, while on duty? How can official police work be "private"? A police officer on duty is a public figure. Of course they should get full privacy off duty... but while on the job shouldn't there be transparency about what they do?
I know what you mean. I guess Triton might be one way people are actually trying that, and further than that there's a lot of people putting years of work into MLIR-based tech, trying to abstract in a retargetable way the algorithm from its 'scheduling'. Might be worth a look if you're into this :-)
Github had one RSA ssh host key, the most widely supported key format.

It was trusted to clone code into the infrastructure of hundreds of thousands of organizations. People pin it everywhere.

With this key someone could infect the infrastructure of fintech companies and steal billions of dollars. I know this well because I run a security consulting company focusing mostly on that industry. Mainly this is possible because almost no companies check for git commit signing, and Github does not enforce it anyway, and I digress.

This key held enough power over value that some might have used violence to acquire it.

With that context of course they chose to place this key in a hardware security module controlled with an m-of-n quorum of engineers to ensure no single human can steal it, expose it, or leak it. Right? ... right?

Nope. They admit they just stuck it in a git repo in plain text where any engineer could have copied it to a compromised workstation, or been bribed for it, for who knows how many years. Worse, it was not even some separate employee only intranet git repo, but their own regular public production infra and someone had the power to accidentally make it public.

I have no words for this level of gross negligence.

Maybe, just maybe, centralizing all trust and security for most of the worlds software development to a proprietary for-profit company with an abysmal security reputation was not the best plan.

I will just leave this here: https://sfconservancy.org/blog/2022/jun/30/give-up-github-la...
in 2023 the goalposts on agi have moved far enough that we are in the bleachers arguing about whether a model was correct to classify a movie review as sarcastic, when it may have merely been acerbic.
More People Should Write
Do Kwon Indicted in US
It’s a message board, not a PhD defense.

What’s the factual basis for your visceral reaction?
When I take stimulant medication for ADHD it makes my sense of smell more acute (sometimes to a noxious degree, unfortunately; I already sense smells more than most people even without the meds). It seems to be a thing, though. I’ve heard similar remarks from other folks with ADHD.
Seems like Google might have the advantage, with all of YouTube to mine.
I have fond memories of that word being used to describe motorstorm on PS3
This article has found its way to the HN homepage multiple times, and every time I wonder if it’s because of the poorly worded and misleading title, combined with the phenomenon of HN users not actually reading the article and just saving it because the title looks interesting.

The article would be much better titled as, “It’s more difficult to explain new concepts to people than you think it is.”
Fallacy of Consciousness
In fairness, it's better that they rotate the key immediately before even looking at the logs. But we can demand better answers from them from this point.
it's python code so not for iphone (?)
We don't even know what kind of society we could have if the value of 99.9% of peoples labor (mental or physical) dropped to basically zero. Our human existence has so far been predicated and built on this core concept. This is the ultimate goal of AI, and yeah as a stepping stone it acts to augment our value, but the end goal does not look so pretty.

Reminds me of a quote from Alpha Centauri (minus the religious connotation):

"Beware, you who seek first and final principles, for you are trampling the garden of an angry God and he awaits you just beyond the last theorem."
Anarchism is a political ideology though. OP is saying that there is much more than simply holding police abuse accountable.
> Do not reveal the problem to others until it has been resolved,

sorry, probably shouldn't have pointed that out. noted for future reference.

aside: big fan of Supabase, Paul! it's a pleasure using it!
Yeah but running them on the same machine is a pain monitoring wise, unless you're really trying to save dollars.
Man, you really like to complicate stuffs just to take a dig at K8S.

>> Local volumes don't have a concept of quota. You cannot limit them to X bytes. So, if you give a single service a volume, it might just take the whole disk.

That's why we monitor our server disk for usage.

>> Obviously, you cannot move local volumes around.

Most of the time, this is not a requirements for database.

>> Since Kubernetes scheduler doesn't really do well with reservations, you may run into situations where your database OOMs or just slows everything down, or doesn't perform well at all

Unless it's test cluster with constraint resources, no other services will run on database nodes, through the use of taint and toleration. We can let the database use all the CPU and memory it wants

>> fsync
Doesn't matter with local volume, since it's just a directory on the host system.

>> Next comes provisioning of high-quality storage for databases... and storage likes to come in the form of a device, not filesystem
We didn't deploy our databases with raw block devices, even before K8S. Using regular filesystems make everything much simpler and we did not see any performance difference.

>> You are essentially preaching the same idea as Electron-based desktop applications or Docker containers that create a lot of duplication of entire Linux user-space + a bunch of common libraries

Yeah, no. If that's how you read it, be my guest, but don't put words into my mouth.
Same as with any other decision: Do a cost/benefit analysis of whether the security risk created by rotating the key is actually outweighed by the security risk of doing nothing, taking into account logs that should tell you whether the exposed key was indeed accessed by unauthorized parties.

To be 100% clear: Both courses of action come with associated security risks. The problem is not choosing one course of action over the other, the problem is thinking you can just skip the cost/benefit analysis because the answer is somehow 'obvious'. It's not obvious at all.
This is the host key, so allows impersonating the server to clients, not impersonating clients to the server.
Italy was unificated in 1861, a more correct title would be to cite all the different kingdoms that composed the country
Came to say that nothing really beats the bottom-up approach you mention, but there WERE some top-down tools over my career that really helped me too:

- Understanding the circle of fifths (and just doing the exercise of playing a simple melody completely through it)

- Understanding the natural tones scale and its mathematical properties (simpler intervals with low integer fractions -> „nicer“ sounding intervals)

- Understanding Euler‘s Tonnetz for the multidimensional relationship of intervals

These were the backings letting me understand a lot of the rationale behind what happens on the keyboard (by all means, a keyboard based instrument makes it SO much easier to grok theory). Though in the end, if you want to play and compose, 80% is building intuition by just trying to first copy styles and second disassembling the chords and melodies behind.
Thanks for the recommendation! I'll check out once it's finished airing :)
In an ideal world this could be avoided by using SSH certificates - an assertion by a trusted party that the key presented by an SSH server is legitimate. The signer of those certificates could be in an HSM, ensuring that the private keys can never be leaked, and the certificates could be sufficiently short-lived that there'd be no need to deal with revocation.

Unfortunately there's no way to make this easy. To associate a CA key with a specific domain you need to add something like:

@cert-authority github.com (key)

to known_hosts, and this (as far as I know) can't currently be managed in the same way that keys are generally added to known_hosts on first use when you ssh to something. So instead we're left with every github.com SSH frontend using the same private keys, and those can't be in an HSM because it simply wouldn't scale to the required load. Which means the private key exists in a form where this kind of thing can occur.
For what it's worth, Linux works great on the current generation. Even sleep works, although it wakes up so quickly that I'm not sure it's actually gone to sleep. I should try pinging it to see.
U1 chip triangulation solves the second part. Would require at least 3 U1-enabled devices in your home.

Alternatively whole-home mapping via AR also solves this. No triangulation needed.
yes, but by then ChatGPT will have advanced by two years.
Siri is garbage because it's trying to be a real AI, as it was understood to be at the time. Alexa works because it's not an AI but it seems as if it's an AI.