skysight-inc/HackerNews huggingface dataset:
> I think TIFF has some unique features that makes it more prone to certain security issues[] compared to other formats, such as storing absolute file offsets instead of relative offsets.

That’s an impressive number of CVEs for a fairly modest piece of code, although the sheer number of them dated ≥ 2022 baffles me—has a high-profile target started using libtiff recently, or has some hero set up a fuzzer? In any case libtiff is surprisingly nice to use but very old and not that carefully coded, so I’m not shocked.

I’m not sure about the absolute offsets, though. In which respect are those more error-prone? If I was coding a TIFF library in C against ISO or POSIX APIs—and without overflow-detecting arithmetic from GCC or C23—I’d probably prefer to deal with absolute offsets rather than relative ones, just to avoid an extra potentially-overflowing addition whenever I needed an absolute offset for some reason.

There are things I dislike about TIFF, including security-relevant ones. (Perhaps, for example, it’d be better to use a sequential format with some offsets on top, and not TIFF’s sea of offsets with hopefully some sequencing to them. Possibly ISO BMFF is in fact better here; I wouldn’t know, because—well—ISO.) But I don’t understand this particular charge.
I'll give em' a palm scan, alright - the two palms I'm sitting on right now.
Most people (87%) take the standard deduction anyway because it's better than their itemized deductions. All those people could just take the bill from the IRS (that would include the standard deduction).

The could also put up a website where you spend five minutes inputing the most common deductions they don't know about. It's not that hard, most filers situations aren't that complex.
The problem is, there's not really a good way to debate "If you have nothing to hide, there shouldn't be a problem." The person pushing for surveillance is going to argue in bad faith that they're the good guys, and why are you stopping them from catching the bad guys? And there's no counter argument to that because it's very hard to find specific examples of where authoritarian governments overreach and go hard on innocent civilians. I reckon when that happens, they manage it keep it very quiet, since they are authoritarian.

On top of all of that, who wants to defend child pornographers? I can see why a person wouldn't even try to engage in that back and forth. There's just no way you come out on top, because basically your side of the argument would have to come down to "Everyone has something to hide, and we should recognize and protect that." It just doesn't _sound_ good.
It's just social engineering, codified. Even in that context it feels cheap.

Lawyers do the same thing as "prompt engineers"-- command mastery of English to achieve a desired outcome. We don't call them Litigation Engineers.
This looks better than the one being presented. It says it still has to code the user name and email switching with the SSH key.
I.e it doesn't do anything more than the vanilla .gitconfig https://github.com/InderdeepBajwa/gitid#todo

I may try the one you linked....
>Also they could put a website where you could spend five minutes entering the most common information they don't already know, and then spit out your bill.

That's basically what they're doing.
First Weapons is an Australian TV series on recently released.
"Phil Breslin meets weapon makers and science experts, lifting the lid on the genius of Australia's oldest and most innovative weapons". https://iview.abc.net.au/show/first-weapons
This case is not going to result in a criminal indictment. It is clearly a 1A violation. Much like how Florida has recently been nabbing people from other states for online posts[1].

In both cases, it seems the justice system is being weaponized to punish those via a lengthy judicial process. Hopefully the defendants will sue for civil rights violations.

[1] https://www.msn.com/en-us/news/technology/what-does-in-minec...
The working assumption (on the part of the US Federal Reserve) is that eventually all/most US banks will use FedNow and offer it to their customers (probably via mobile/online front-ends developed and sold by B2B third parties).

We'll see if that actually happens.
There would be a conflict of interest if the IRS was incentived to maximize tax revenues. Are they? Does anyone at the IRS get paid more if tax revenues are up in a particular year?

I would think that they're only incentivized to accurately apply the existing tax laws, and those laws are written by a separate entity.
Docker comes with its own problems (especially if you need to mutate the image under the hood). And multi arch quickly becomes a pain. Also much harder to make it truly portable.

We're rolling something around conda+conda-pack and plan to contribute it upstream. Look out for a blog post on HN later this year :)
They're hinging their view on the word "primary" with respect to functions in the code base: "Only an incredibly tiny portion of our code is actually related to circumvention". That is only one way in which the word "primary" might be applied here, with another being the primary thing users actually do with Dolphin. A glance through sites that have such things shows that available content & downloads aren't homebrew, it's ripped game ROM & disc images.

I'm saying I like this part of the DMCA, or the way Nintendo bullies people around on things like this, but the legal area here is much more gray then the Dolphin folks seem to believe.
SF biotech company FibroGen laying off a third of its workers
From the Statistical Consequences of Fat Tails (N. Taleb):

"We will address ad nauseam the central limit theorem but here is the initial intuition. It states that
n-summed independent random variables with finite second moment end up looking like a Gaussian
distribution. Nice story, but how fast? Power laws on paper need an infinity of such summands, meaning
they never really reach the Gaussian. Chapter 7 deals with the limiting distributions and answers the
central question: "how fast?" both for CLT and LLN. How fast is a big deal because in the real world we
have something different from n equals infinity."

https://arxiv.org/abs/2001.10488
Is there anything special about the IBM MQ implementation which makes it worth naming them? It looks like you can connect to it using AMQP so I wonder why they wouldn't just say something generic like "MQ" or "AMQP protocol".
A RTX 4090 has a much better value for stable diffusion but yes if you start to think about cost the pi wins. If you think about availability, I’m not sure.
For the TS compiler: If you took each generation step, closed any partial JSON objects (ie close any open `{`), checked that it was valid JSON and then validated it using a deep version of Partial<T>, that should do the trick.
The "central bank" americans fought hard against in the first place didn't have the same function as the modern central bank started last century.
Finally, an AI platform gets a beautiful brand identity
Agreed. I get excited to see "headless components" until I read the fine print that it's locked into framework x (usually React). I wish there was a robust headless AND framework-agnostic component library (preferably relying on Lit or Stencil).
There is no shortage of google collab stable diffusion tutorials on the web
I've been out of the industry just long enough to remember that Cerent 454's got rebranded as Cisco 15454's right near the end of my tenure...

Yow. Way to make a guy feel old! :P
50k is small peanuts, even for a friends and family round. I’d expect any startup dealing with banking transactions on my or my businesses’s behalf to have at least that much in a bond or escrowed away for counterparty risk.
You mean, bad journalism is a form of activism. Good journalism aims at objectivity, and allows readers to form their own opinions.
I'll just add, that if you would like to read clean python (incidentally often about natural language processing) Norvig's work is well worth a look - explified by the essay on writing a spell-checker:

http://norvig.com/spell-correct.html

Now dominated by notebooks, linked to from norvig.com:

https://github.com/norvig/pytudes#pytudes-index-of-jupyter-i...
It'll go in stages...

First customer service,

Then replacement of call centers.

LLMs will then be incorporated into videogames... NPCs you can actually talk to who will address you by name

Then there will education... A well tuned LLM can substitute for the bottom 40 percent of grade school teachers.

The real question is what aspects of this are monetizable? The truth is all software becomes a commodity over time. LLMs will become cheap, then they will become free (they already are with LLAMA). The truly valuable companies have network effects that keep users coming back. LinkedIn, Google, Union Pacific, GitHub, Microsoft windows are all network monopolies.

From that perspective, the most valuable LLM company will be the anti-LLM companies.

Facebook, Tinder, Twitter, Instagram--- all considerably less valuable once the majority of their user bases is replaced with extremely high quality bots. The real consumers may gradually sign off and take their money elsewhere. In that world, a naive person would try to build a bot detector. But a good bot detector can simply be used to build a better bot. Instead, to win at this game, I think the most important way to win with LLMs to devise better forms of human authentication!
Consider "We have every intent of creating a digital dollar and are actively planning and working on that project BUT FedNow has NOTHING to do with that project".
My Beautiful Friend
Of course they aren't. But they could if there was automatic billing.

Or simply ask you if the most common situations apply to you, just like turbotax does.
LOL what? Keeping private keys private is not "security through obscurity". Or if it is then basically all security is security through obscurity.

No one is posting their private keys on github, and when they do their crypto goes poof nearly instantly. None of the exchanges publish their threat model documents. I sure as shit don't tell people where I store my private keys.

The bitcoin whitepaper and code are more analogous to the ISO standard, which is public.
Yeah, few days ago:

https://docs.oxide.computer/release-notes/system
FBI Fd 1023 – Biden Bribery Evidence
MINIX and BSD were already free. More free tools would crop up, just like free Windows tools abounded since their inception, like the hobbyist software that was traded for free before that. Nerds who just like making software would always have kept giving it away for free, because they just like the fact that they can and it's fun to do.

It didn't change the world that much. Nearly every company that makes internal software refuses to release it for free. They'll happily use whatever you give them for free, of course. But even if it weren't around for free, they'd just pay for something else. Most people would probably use Android as the example of the "revolution" paying off, but before Android everyone just paid to license mobile OSes, and they will again when Android eventually dies. Business does not care about the morality of a license, nor sharing code. You pay for what you need when you need to, don't pay for what you don't need to, and pass the cost on to the customer. Simple as that.
This and IRS Tax filling all happening today. From an outsider perspective the only two major thing left for US to fix is Medical Cost and Public Transport.
It would be an epic failure if the government issued a tax collection software contract out and didn’t put in some sort of clause preventing intuit from providing a competing service. I have a hard time seeing them do something like that.
what is there to elaborate, other than pointing out that he was good at social engineering things and finding behavioral or procedural loopholes to get access to systems?
The gangs clearly aren't trying to war against the state. If they were, I imagine the scenario would result in the national guard or a result akin to Mexico.

If the gangs wanted to make a stand against the state, they could. They would need to take and defend their territory while increasing their numbers, likely via kidnapping and child recruitment.
They will say what for and give you the opportunity to dispute it. You can even call and talk with someone. They aren't faceless, heartless, or infallible. If it's their mistake, or an honest mistake on your part, they're pretty easy to work with.
Looking forward to seeing if it syncs across ZeroTier networks. They emulate a LAN including multicast so it might work out of the box.
The Cerebras chips look impressive:

WSE-2: 2.6 trillion transistors, 850,000 cores, 40GB of SRAM, 20 Petabytes/sec memory bandwidth
I would not be opposed to the gov subsidizing 50% of salaries of chip manufacturer salaries to achieve this.

It's a crucial part of industry growth and military superiority. We have some of the top-tier minds for chip design, we need top-tier manufacturing.

Nvidia/TSMC has already proven that hardware superiority is a huge advantage. We absolutely need it.
The way the content of this article is presented angers me. Just why?

That is all...
That’s where I landed. i figured better odds of 3-5 and 2 on target with a 10mm recoil vs 1, maybe 2 out of a revolver and 1 on target with massive recoil if I didn’t want to carry a very long barrel.

The round size you’d need to drop a bear quick basically implies you should hike with a rifle. So if you can’t do a single shot approach that makes sense (ie hike with a rifle), multiple shots with lower recoil and suitable bear load seemed logical. Then YouTube Alaska guy did all the ballistic pros/cons too.
I'm confused. Are you suggesting that having a team dedicated to discovering zero days means that this team will discover all zero days that could possibly exist?

Or even, that they will discover all zero days that will be discovered before anyone else discovers them?
woah woah dude, spoilers!
> Over 30% of the traffic to this website is rss feeds. Google just doesn't matter on the modern web.

RSS feeds are dead, long live RSS feeds.
As someone who's only dealt with commodity server hardware, these specs make me salivate. And all these boot/management TUIs are just so satisfying to look at.

(Sorry to be that guy, but just a friendly suggestion: high contrast dark themes are difficult to read for people with astigmatism. Especially since this is technical documentation, intended to be thoroughly read, you might want to consider a light theme toggle.)
You should be more like us Americans and give it up of your own volition to any private company who gives you a moment of free entertainment.
No it's not. They are setting up a free filing that will still ask you to input forms they already know about just like turbotax does.
https://github.com/lit/lit/tree/main/packages/lit-html
hard to say if there is a -cure- (apart study, culture, empaty..) but maybe finding what fuel BS can reveal how to reduce the trouble.. just an idea:

In a small human group (in the last, say 50k years, but probably a lot more), there are no space for BS, apart jokes, or seriously consequences on survival will occur.

Today billion of humas live in a global group, words/information/data come fast and in quantity unmanageable. Reason has to work hard, and BS in the flux come and has spaces to stay, and consequences are delayed and indirect, damped by so many complexity/levels in the social structures (to simplify a lot).

At the beginning of newspapers era, come also some BS (propaganda), but action was manageable, it was not too fast, too much/per-day, we have time to rethink about the news of the past day, bu neverthles bring nations in wars and begin revolutions..

Now simply is an overload, we can't manage it. It's like a virus (pardon L.Anderson), and any cure is totally on the peculiarity of the intellectual-immune-system of the single, but for the humankind exposed is a caos, litterally, like pollution, is simple too much.
Wonder if anything can be learned from the gambling industry.

Gambling is a vice and can be a damaging addiction. Yet it’s legal in many places and while there are stories of people gambling their life away, society doesn’t seem to see it as a major problem (and in fact is promoting its use via legalization of online gambling)
> Assume that it is good that the government be able to snoop on your text messages. Why not in-person conversations as well?

Playing devil's advocate: in most US states, the FBI can in fact plant someone with a wire to record a private conversation. They don't have the resources to record all in-person conversations, but maybe they would if they could.
It's interesting how Nix's selling point is that its non-standard file system structure allows multiple versions/flavors of the same package to be installed at the same time, yet if I understand correctly, it often has one version per package per Nix version? It's more like install multiple versions of the same package at a different time?

Compare this to the model we have in Spack (which is inspired by nix), where there's one recipe per package for many versions, and you can define different build flavors, conditional dependencies (and conditional pretty much everything).

The difference is that Spack has a dependency solver and Nix apparently does not?

For example the curl package [1] has tons of versions, and its `tls` package variant has conditional values depending on the version:

variant("tls", values=("gnutls", conditional("mbedtls", when="@7.46:"), ...), multi=True)

And dependencies are specified as

depends_on("gnutls", when="tls=gnutls")
with when("tls=mbedtls"):
depends_on("mbedtls@2:", when="@7.79:")
depends_on("mbedtls@:2", when="@:7.78")

This allows you both to install all sorts of curls, like `spack install curl tls=mbedtls` (gives you something >= 7.46), or `spack install curl@7.77 tls=mbedtls` gives you a curl with an old mbedtls, etc.

[1] https://github.com/spack/spack/blob/develop/var/spack/repos/...
> So only a finite number of people would have access and it would be costly to re-publish or re-distribute that hard copy information.

You hit the key point: information distribution has costs. It always has. And that cost always kept bad actors somewhat in check. Making information reproducible only in a local context was safe-ish.

Until the internet of course. Now it's logged on every physical drive that happened to cache your information.
There is also power in discovering how to forgive yourself, especially if your wrong was unintentional, or you made a mistake that you deeply regret. It's too easy to walk around with guilt in your life, and maybe you don't ever get to speak to the one you wronged. Should you take that to your grave? Does that help anyone?
It could shine, or it could be an absolute disaster.

Code/functionality archeology is already insanely hard in orgs with old codebases. Imagine the facepalming that Future You will have when you see that the way the system works is some sort of nondeterministic translation layer that magically connects two APIs where versions are allowed to fluctuate.
A 17th-century font in a 21st-century thesis
Laying a board over a seam in the subfloor sounds like a titanic pain in the ass. Diagonal means you might have to move the nail a little. Probably also limits the amount of dust and water that passes through from floor to ceiling.
> One of the profound contributions of Christianity, corroborated in other wisdom traditions, is the assertion that every single one of us ignorantly does irreparable harm to others in the course of our lifetimes.

The problem, though, with Christianity's take on it (or at least what some Christians take from it), is that they push the idea that all you need to do to achieve salvation is to believe in Jesus as savior, and all is fine and dandy. Doesn't matter what sins you've committed, or if you're even truly repentant. Just believe Jesus died for your sins, and you're good.

On one hand I agree that this could promote acceptance that we are all flawed beings, and will all end up doing bad things here and there, and that it's pretty much unavoidable. But I worry that this also can promote a sense of invulnerability and unaccountability. "Doesn't matter what I do, Jesus will take care of me."
This is a line of thinking that really intrigues me, are there any external resources you would suggest to further read about it? Other than the Bible, of course
You can use that, but there are pretty well understood terms in finance already (like retail investors), and probably best to use the standard if you want to be well understood.
Because they just had a major breach and they're doing damage control.
picture for example stalone and schwarzenegger combined into one person.
You're ascribing motivation and agency to evolutionary pressures. I'm talking about individual behavior. Evolution isn't rational or irrational.
Public libraries are essentially the temples of knowledge, that is they are places where likeminded people congregate and perform rituals - reading books.
Funny - where I live, people do the exact opposite...
Kind of unrelated, but didn't the IRS also "move forward" with login.gov integration? Wherever did that go?
Think thing is that Ionic have proven this can work with the massively underrated Ionic Framework (built with Stencil, which they also built). I just wish they expanded a little further into desktop UI components and provided an no/low styled variant - I dislike Material as a base style, it's too opinionated.

They are 50% of the way to building a universal mobile+ desktop ui toolkit.

Do the same with Ionic Capacitor, make a desktop version, and that would be an incredible improvement over Electron - it uses the OS supplied web view.
Can anyone tell me a reason why either 'hacking' a prompt, leaking it or trying to keep your prompts hidden has any kind of value?

All I see is you found a way to get it to talk back to you when it was told not to, which a toddler does as well for the same value.

I can't imagine any, or any meaningful amount, of the secret sauce being in the words in the prompt.
The last part is also useful. Tells the next person where to look when they do run into scaling issues, and also tells them that there wasn't some other reason to do it.
The IRS will always need some info from the tax payer.
> having robust alerting and monitoring tools, good rollback plans and procedures/automation should eliminate this fear entirely.

Sure, but that all sounds like stuff that happens after you deploy/release… you really need to catch things sooner than that. Don’t make the user into the one who has to find the breakage, please. No matter how fast you roll back. Test your software thoroughly!
> they'll probably be able to find a bank willing to charge them < $0.25

I guess that includes some very small values, but the upper bound seems ridiculously high.
> So here’s my radical proposal: instead of mindlessly fitting a theoretical distribution onto your data, use the real data. We have computers now, and they are really good at performing the same operation over and over – exploit that. Resample from the data you have!

Hmm.

The problem with fat-tailed distributions is that often the real data doesn't actually show you how fat-tailed the distribution is. The author notes this later, but doesn't discuss the difficulty it creates for the suggestion of "using the real data":

> In other words, a heavy-tailed distribution will generate a lot of central values and look like a perfect bell curve for a long time … until it doesn’t anymore. Annoyingly, the worse the tail events, the longer it will keep looking like a friendly bell curve.

This is all true, but the author misses the immediate corollary: the worse the tail events, the longer using the real data will mislead you into thinking the tails are fine. Using the real data doesn't solve the fat tails problem; in fact, resampling from the real data is sampling from a bounded distribution with zero tails.
> Founded in 1993

And they say investors are impatient...

(The company is still losing money, 30 years later.)