skysight-inc/HackerNews huggingface dataset:
Video demo of hacking the pixel 6's modem, and intercepting SMS messages.

source:
https://www.blackhat.com/us-23/briefings/schedule/index.html...

pdf slides:
http://i.blackhat.com/BH-US-23/Presentations/US-23-Karimi-Ov...
Yes, he could definitely use that time to find someone else who's been working on it for a long time and steal the glory for himself, as he is known for.
We replicated the behavior (somewhat) of the article, using podman, as a way to allow devs to SSH into a container that was identical to the CI/CD environment.
It also mapped in their NFS home drive, so they could quickly SSH into the container to try a build, to see if it was their dev machine, or a real issue.
It did allow them to choose their container though.

https://github.com/SEL4PROJ/imagesh/tree/master
It's not just the street runoff. You have to consider all the stuff in the water basin that is draining into the ocean closest to the beach. For example, many coastal communities might not have a sewer system, using septic tanks and leach fields instead. When it rains enough, some of the runoff gets into there (ever seen pictures of septic tanks improperly secured that pop out of the ground after a rain?) and then moves down to the ocean. Then you also have agricultural/animal runoff if there are farms or ranches in the basin, and potentially industrial runoff if there's any heavy industry in the area too. And even if you have none of these factors, just the simple influx of nutrients can cause things like algal blooms that can be just as bad.
> Rust has a much stronger type system and the borrow checker. Both make bugs far less likely.

I really prefer strong type systems over weak ones, but despite that, I always like to point out that there's no evidence that strong type systems cause "bugs to be far less likely". No study I've seen (quite a few) has ever shown that.

There's a few bugs that become impossible (in Rust, some kinds of data races for example) but the vast majority of bugs can still occur and in practice, do occur.
What goalpost did I supposedly move?
Has anybody read modern[^1] science fiction that uses "scientific and technological breakthroughs"? Or, something close in thoroughness to Jules Verne "Twenty Thousand Leagues Under the Sea" or "The Mysterious Island"? Is it just me, or modern writers are terrified of getting wet with that sort of scientific level, or the general public that buys and reads fiction is not up for reading that type of work?

[^1] Like, published in the last twenty years or so.
Rust and Go have almost no relation to each other - one is a low-level language, like C, C++, the other is a high-level one like Java, C#, Haskell.

These articles and this general notion that the two has some relevance to each other is just plain wrong and harmful.
In the meantime I maintain an unofficial apt source that autogenerates packages via GitHub actions - https://github.com/notbobthebuilder/podman
https://tintara.tripod.com/FramesSuck.html
I’d hire a Python developer any day of the week over either Go/Rust.

Need some data science work done, easy. Need a web server done, easy. Need things to be fast and relatively performant done, easy.
I believed fanboyism was left at the 2010s
> Of course you would have to slow down

Not particularly necessary, most of the starshot type plans made seem to be fly-bys.
The 1 kilobyte of extra data to send to start a session sounds like it could have quite a performance impact, especially on slow connections, or occasions where it causes an extra RTT.

Is there really no way to reduce the size of the data needed? After all, even the fastest supercomputers available won't be counting to even a 64 bit (8 byte) number anytime soon, so you would imagine that if the crypto algorithm was perfect then 128 bits should be plenty for key sizes, and 256 bits gives a decent safety margin.
I did mostly work on python and Java. Whenever I apply for positions using golang they stop my application process after learning I don't have work experience in the language.

May be this doesn't happen in FAANGS but I see it is the usual thing around.
Go is more verbose than Java, which you may very well consider overly verbose. The only reason it is between Python and Rust is that the two languages are two extremes of low-high level languages. Go is as expressive as C, which is a negative.
Had a quick read of [3]. This work comments on three contributions to the error in an analog scheme to solve linear systems via an ODE that is encoded in the circuit dynamics, although the specific ODE being solved is not given in the paper. The three sources addressed are: gain error, offset error, and nonlinearity. It is mentioned that the first two can be corrected by calibration, while the nonlinearity error can be mitigated by scaling down the inputs to the problem (the matrix A and vector b in the equation Ax = b). It says that scaling down the problem results in lower accuracy, which I suspect can be captured by the tradeoff we show analytically between time, energy, and accuracy. It is also mentioned that “when the analog accelerator outputs are steady, we can sample the solutions once with higher-precision ADCs. However, the method here does not involve time-averaging the output of the circuit. A core result of our paper is that the accuracy converges with the length of time over which the output is averaged, so I suspect that taking a single sample is a drawback of the method presented here.
>>And supposedly, layoffs aren’t legally allowed to be performance or merit-based!

Where is that? Even in the EU where employee protections are very strong you can absolutely let go of someone because of poor performance, you just have to do the whole dance of giving them enough warnings, then a PIP, then you can terminate their employment as they are failing their contractual duties. It's not super simple but it is legal and it does happen.
That’s not true at all. Have you actually used one?

Edit: obviously if you need a windows vm you’re out of luck at 8gb ram
What is the recommended resource that helps one become proficient at Rust nowadays?
I used the M1 Air 8/256 as a dev machine for a whole year. It was faster than a 16/512 Intel 16" MBP from 2019.

Calling it a Facebook machine is silly.
Not an expert, so posing a few questions in response to the article:

- Barring market microstructure considerations altogether, aren't there human-engineered failsafes in place to prevent market selloffs? Most recent and salient example that comes to my mind: circuit breakers during the multiple day sell-off on news that COVID was indeed serious.

- Additionally, weren't most fears re. algorithmic trading in the US equity space addressed in the early 2010s?

- We saw Zillow (using Facebook's Prophet), Redfin, and Opendoor apply algorithmic trading to homes. Did they really have an outsized effect on housing liquidity? A superficial look at the numbers tells me that on paper, wealth was redistributed from their pockets.
Little known fact is that the M1 does not support nested virtualization. As a college professor I really miss that during Docker classes. Supposedly the M2 does. Can anyone confirm Docker works under Windows on Parallels?
Whenever I see comparisons between Rust and Go, I'm always reminded of fasterthanlime's I want off Mr Golang's wild ride [0] as well as its sequel Lies we tell ourselves to keep using Golang [1].

Having used both, Go hides its complexity behind the veneer of simplicity while being more tedious and error prone as the codebase grows while Rust brings the complexity to you upfront while preventing errors later. Personally, even simply due to language features like algebraic data types in other languages, I really have no reason to use Go anymore. There's an oft-said quip that says that the Go language designers took the last 50 years of programming language theory and simply...threw it away.

Plus, to those saying it's easier to hack stuff together in other languages than Rust, I simply clone everywhere and Rust then becomes the same as a garbage collected language. You don't have to deal with lifetimes and excessive cloning from the get go, deal with that after experimenting then optimize, same as you would for any other language. The plethora of language features in Rust make it easier to hack around in, in actuality.

[0] https://fasterthanli.me/articles/i-want-off-mr-golangs-wild-...

[1] https://fasterthanli.me/articles/lies-we-tell-ourselves-to-k...
Until we finally get liability across the industry, then devs will think twice about shipping CVEs into production.
Would be nice to add a short disclaimer that you are the author of the V language (at least it seems from your username, correct me if I'm wrong).

There are many new languages in the same space (Zig, Nim, V). However, if you use a language outside hobby projects, you are dependent on a language having a long-term healthy ecosystem. Of the newer native languages, only Rust, Go, and Swift have enough traction to bet your livelihood on.

In the end, having a rich ecosystem with good libraries and tools is going to leave a far bigger mark on productivity than relatively small differences between Rust, V, Zig, Nim, D, or whatever.
Amazing news... but just go outside once and open your eyes?
The conclusion completely handwaves the massive overheads that come with not only owning your own infrastructure, but also having to manage a complex platform stack and its security.

The security points, which the main points hinges on, seem hyperfocused and in most cases misguided.

Redshift is not internet facing. If your Redshift is internet facing, you've messed up somewhere.

The CPU attack example given is for AMD ZEN, which the most common AWS workload CPUs aren't. Further, the benefit of using a cloud provider is that they put mitigations in place for most exploits, whereas running your own stack means it's now on you; running your own stack does not excuse you from having to put mitigations in place.

In the examples again, the speed to market's problems are a reflection of your organisation, not the cloud.

Stepping back a little, I'm thinking (as terrible as it is) that this is a case of blaming the tools, but never yourself; a lot of the problems the author is seeing seem very specific to their observations but are a poor use and poor understanding of AWS in general.

Overall not a great article, with a headline designed for people who already dislike AWS/GCP/Azure.
That causes concurrency issues, but that is not what is commonly understood by memory safety.

With that said, Go indeed gives you plenty of rope to hang yourself with in relation to concurrency (among others).
It's a video game, but Yoshi's Island's title screen (https://www.youtube.com/watch?v=ZkbxyPl83yI) has sound effects which fade out into a musical theme (which adds instruments after the noises stop). It fits cleverly into the SNES's 8 channels of audio which might not have been able to play ocean spray, birdsong, and multiple overlapping xylophone/melody lines at once.
I bought C++ Primer in 1990 because I needed to learn the language for my masters thesis work. I remember it being unusualy well written, clear, and above all concise. I read it several times back to back over a few days.

Knowing C++ back then (perhaps more than having that MSc) got me my first two jobs.

So thank you Mr Lippman, and rest easy.
Feels like making this an official thing would immediately lead to it being abused so much that people will stop paying attention, like they do on other social media.
I wonder how are they "detecting adblock". Let's say I have an alternative youtube client like smartyoutubetv. What will they do? Check if ads are loaded? Fine, the software can be written to load the ads, but not display them. Will they check the timing info? (that you pull a part of the video, then pull the ad for 30s,then the rest?). Will they encode the ad right into the video stream? The app can be coded with a play buffer. Like the tivo "skip ads on TV feature" of decades ago.

There is no way youtube can win this battle using "brute force". The only way they can win this is by offering a new better service, not deteriorating existing ones. What could that new service be? How about recommendations that don't suck? I used to watch a lot of youtube on my TV from the main page. These days I only use a list of my subscribed channels and a search feature.

Also, if youtube gets really aggressive people will go elsewhere.
Most of my complaints against Go are kind of waned, however can we at very least have Pascal like enumerations without iota const dance?
Godot is wonderful. But GDScript is a horrible, terrible, ill conceived idea.

So how's the QuakeC development ecosystem these days? How good is ChatGPT at generating QuakeC?

Who's still programming Unity3D in Managed JScript or Boo?
Cargo Cult Science (1974) [pdf]
> Go is more verbose than Java

In real world use ridiculously so.

The lack of exceptions, Option type or ability to chain or manipulate errors means every line ends up wrapped in a 90s style "if error" check. Which ends up making code less robust than languages with more modern approaches like Rust, Scala, Swift etc.
My org insists that the disks of all obsolete machines are destroyed and the rest of the hardware sent for disposal.
I have a few systems that could be wiped and given away for charity but that’s not allowed.
This seems incredibly wasteful to me.
Was there any explanation/reason given for the ban?
Having built our startup on Rust with no prior knowledge of it: These are not facts but subjective opinions that might be true for you but not for everyone.

We tried both Rust and Go

-Rust is very suitable for fast pace environments because I don't have to worry at all about a whole class of issues

- Almost all of us learned Rust on the job and it worked quite fine. The more you learn the better you get, same is probably true for other languages

- We found that Rust devs are not more expensive, quite the opposite. We have people willing to switch jobs just so they can develop in Rust

- We found that adding "rust" to the job adverts increases engagement by .. a lot

- The others are even more subjective and also not true for us

I don't doubt that this was your experience at all. This might even be a majority opinion even though I doubt it. But it is definitely not true for everybody.
You are making a compelling argument that grassland has a richer diversity of grazers. But surely the diversity of fauna is richer in the forest.
Sure.

The ability I have to leave my house and walk around is of a different quality to the ability I have to go to the supermarket and buy some food. Positive vs negative rights, something like that. I'm feeling lazy in my explanation but probably you know it already. :)

With drug abuse I feel it's quite simple. If you want to do meth in your home, I think you're a bit daft but I'm mostly happy for you.

If you end up in a tent city under a bridge abusing passers by and committing crimes to get your next hit, well, we should punish that hard.
> Frankly, ssh-to-container is a "slaps forehead" obvious solution and I'm surprised none of us thought of it before

I think CNCF is at the point where you can assume that "there's a CNCF project for that" is true for anything container/kubernetes related.

https://www.cncf.io/projects/containerssh/
Youtube seems to have a monopoly in the same way that Reddit does--it offers a product with network effect that you can't get anywhere else. However, most of what I use Youtube for is entertainment, same as Reddit. When Reddit turned to problematic, I had no problem not using it and switching to other forms of entertainment.
I have the base model $1k M2 air and it functions excellently as a development machine. Both web dev for work (running multiple react clients, node servers, Pg instances, docker containers, etc all at the same time), and for basic game dev for recreation - though admittedly I’m using Godot for that which is among the lighter weight game engines available.

That to say, it’s far more than a glorified Facebook machine and is a truly excellent value. I much prefer it over my work issued intel MacBook Pro.
It also runs on others like freebsd, so yeah, I read it as runs best on major platforms and less well on others.
Interesting that he selected "match" as example of a complex Rust feature. To me, "match"/"case" is one of the simplest and cleanest abstractions in programming languages.
As a German, I can at least say that the propaganda worked here, as intended :)
Of course you read the books then you practice and get feedbacks. I’ll argue you can learn drawing this way like many other things.
https://support.mozilla.org/en-US/questions/1339535
https://support.mozilla.org/en-US/questions/1386107

Look what an unholy mess the new change to audio playing status has caused.

To summarize, in compact mode you will get the audio playing icon on a tab but it will hide the favicon in that case.

In normal mode, and only if you have a small number of tabs, you will find a tiny 'PLAYING' text instead. If you hover over it, you will find the playing icon...which will have hidden the favicon then.

UX geniuses with too much time on their hands.
Most of my Apple laptops I have given to other people who have used them for years. Of the three M laptops I have (including the first M1 Air), none has any issues so far. If one breaks, I would let it repair at Apple. My personal main Laptop has AppleCare to make that less costly, in case something breaks.
True, Go has an amazing ecosystem. A great stdlib and libraries.

That's why we're working on Go2V, which will be able to fully translate Go code to V. (Having a language so similar to Go also helps.)

It's already been partially used in our translation of Go's crypto modules:

https://github.com/vlang/v/tree/master/vlib/crypto
There is no question that authors delivering the work themselves is preferable. But that option is rarely available (only 20% of NYT Best Sellers have audio books read by the authors).

| "you’ll just end up moving this information from being locked in prose to being locked in sound"

I don't think that everyone shares this opinion. Your fellow YC Batchmates are very happy that Paul Graham's essays are now in audio format as an example. More than 1000 founders have subscribed to the feed.
It's not just a question of on average how much faster it is, it's a question of whether the distribution of latencies matters.
Was your account new as well?
Not really. I use unwrap and clone everywhere and I can do everything as if Rust were then a garbage collected language, and I can then test out different solutions, hack my way through, just as I would in Go or Python. Then once I have a good solution, even if I don't optimize it, it is leagues faster than Python and even faster than Go. If I do decide to optimize it, then, it's fast, really fast.

IMO those who say Rust isn't suitable for hacking seem to try to conform to best practices right away when really, dealing with lifetimes and excessive clones should be part of the optimization step, not the ideation and experimentation steps. Rust is as high level as you want it to be. Hell, I write web backends and sometimes even frontends in just Rust and I never worry about memory until I want to optimize, if I even want to optimize.
But how much of what is traded in is actually repurposed?
Iveco battery swaps could be key to electric vans
ICAO 9303, part 10, section 4.7.11, data group 11 allows for a list of other names.
Also running everything on Hetzner that can possibly go there. Then I regularly see startups proudly explaining how they are wasting incredible sums on AWS when the same thing could be done 100 times cheaper with Hetzner and Cloudflare. Makes one think, dude, why??
What am I supposed to see there?
https://en.wikipedia.org/wiki/Poverty_in_the_United_States
> without double checking

It's fine, Nix things are conceptually different from anything before.

You could say flakes are like Rakefile, but that would be a lie. You could say they're like Gemfile and Gemfile.lock, but that would be a lie too.

You could say that derivations are like packages, but that would be a lie, you could say they're like container images but that would be a lie too.

Now, you can try to understand what these concepts are by mapping to known knowledge of other things in terms of use cases they solve, that's fine, but at their core these concepts are different and quite unique, so it only makes sense for them to have different names.

Naming is hard, Nix folks had to pick one for each concept, and they chose not to lie by picking existing names that would not map and create bias in the understanding and expectations. It makes for a steeper learning curve, but I'd argue long term in the learning process it's the right move.

Let me try to give some synthesised definitions (which may be incomplete and lies in the Feynman sense):

- a derivation is the reification (or realisation, as in, "make it real") of a function call on the filesystem. IOW the concrete result is derived from the function call, memoized using content addressing.

- a flake is a central definition of a number of target derivations in the context of a specific source state of dependencies. If you look at an actual (snow)flake there's this recursive/fractal design coming from a central point, which kind of visually represent the conceptual structure underpinning a nix flake.

So for me the names totally make sense! But I can understand that they don't out of the blue (and they did not for me at first!)

It turns out (not really by accident) that these cover use cases that were implemented by this or that tool, and instinctively through a partial understanding of the nix concepts we're in conflict: the other tools give us a (biased) understanding which both increases and is in conflict with our understanding of nix concepts. This is a normal process, but at some point by letting go of what we previously know and trying to understand new things for what they are and not what we project onto them, we open ourselves to fully grok, and both fully leverage the new concepts and realise their limitations.
Naturally the first vulnerability they point out was never exploitable for cross-VM attacks on any major cloud provider at any point…
> Go code can be expected to compile 10+ years ahead. The same is not always the case for C, C++, Zig and possibly even Rust.

I'm sorry, but this comment just seems so blind to reality that it's hard not to comment on. C has a few particularly strong selling points:

* Orthogonality to machine architectures

* Freestanding (STD-free, in modern language parlance) compilation

* An extremely conservative ruling body

The latter is usually listed as a double-edged sword, since there are many new features people would like in C: true generics, polymorphic (overloaded) functions (without using the pre-processor), a true module system, etc; but it also means extremely old code compiles just fine on modern C compilers. Now, it might not work because it might be built for some bespoke hardware/environment, but the code will compile fine and be correct.

For instance, here's a perfectly valid ANSI C application that will compile on any C compiler in the last 35 years (three times as long as Go has existed):

https://godbolt.org/z/ja6WM5feT

Most of the features added in C11, C17 and C23 are additional features, usually with no backwards breaking changes. However, in some cases they do clarify undefined behavior; which can break old code. This is why most of the major modern compilers add flags to compile in specific dialects.

Additionally, there are plenty of Go 1.0 (the first [and only] "10+" [11] year old version) codebases that won't compile without major changes.
If the longer side of yellow = y, and the longer side of the orange = o,

// yellow+pink+green area = 3 x orange)

y * o = 3 (3 * o)

y = 9

Side of square = 9+3 = 12. So area is 144.
Mythic Beasts also good.