skysight-inc/HackerNews huggingface dataset:
Maybe the presence or absence of this capability could be something disclosed on the label? It's an idea worth thinking about. I encourage you to file a comment with your thoughts on the matter. You probably want to focus on how this information could help a security-concerned consumer/business make a better purchasing decision. Or if you're arguing that this be a hard-requirement for the label, why a device should not be considered secure without this capability.
Diverse Open Source uses highlight need for precision in Cyber Resilience Act
Deliberate deception is a lie. Feel free to call it as it is.
Now it's PostgreSQL's turn to have a bogus CVE
> It forces the customer to focus on getting the requirements right

This is an issue that the article does not address, and it should. Part of the business risk that the article is talking about is the risk of ill-specified requirements from the client. But that means that any flat-rate pricing has to price in the extra time and effort required to make sure the requirements are well specified (and that's true even if a fair amount of that time and effort happens before a contract is signed--you still need to recoup those costs somehow). Either that or you simply have to not take on clients who can't specify their requirements well enough up front.

> consider their motive

I agree, this is always a good thing to do.
Yeah "on crack" usually means they're not right in the head.

In this context though, OP is referring to the drug where the Github engineers are being quick/energetic about fixing the issue because they're "boosted" by the drug's effects.
It's trivial to fix with an ECS layout, but the point is does it matter.
The location of the string is pretty telling: right after a 256 byte header, and occupying the first few bytes of a long run of zeroes. This isn't how you'd expect to find a constant embedded by a compiler or linker as part of code implementing a check for the presence of a crack.
If you can use open source, you can build hardware
UA grounded all flights due to a computer issue
This is more common than you might expect.

The Windows port of Marc Ecko's Getting Up: Contents under Pressure being sold on Steam is the DEViANCE crack.

Open the game's exe in a hex editor and you can plainly see "DEViANCE".
Return-to-Office Is a $1.3T Problem Few Have Figured Out – BNN Bloomberg
Macbooks sell quite well despite the implementation details you mention.

And don't confuse "grumblings on tech forums" with a "strategy failure". People on forums can bemoan the lack of a 3.5mm headphone jack all they want; the success of a business strategy is measured in dollars:

https://d1-invdn-com.investing.com/content/127a7c89dbe82ad5c...

https://www.statista.com/statistics/263402/apples-iphone-rev...
Come on, I was at Molière's level of comedy !
Also, one of the single most important parts of security is human manageability. Having to go into a proprietary app for each manufacturer.

There's this level of management at the google/amazom/apple level, and in some cases google even lets me push firmware updates (sennheiser ambeo is an example), BUT there should be a requirement that security settings in firmware be exposed in a way that they can be manipulated in a rolled up dashboard. I shouldn't have to depend on a first party app to stay maintained to get to the settings for a device.
Taking a trip to Newcastle presumably.
My OPEC comparison was more centered on a small group controlling a critical resource who can control the price regardless of the needs of the consumers of said resource (not the historic price action). I agree with most of your points, but want to stress that the desired outcome should be responsible use and stewardship of what is both a highly useful and nonrenewable resource. Pricing is a component, but maximizing profit should not be the goal. I'd even go so far to say that you either wouldn't sell to consumers of helium who could capture and recycle it but currently choose not to, or you would subsidize the installation of that equipment for them out of the proceeds of more frivolous uses.

My personal opinion is the goal should be to maximize the utility of the resource, with any profits being second order effects. Instead, we too often end up like ancestors who raze the forest only to freeze to death in the winter [1].

[1] https://en.wikipedia.org/wiki/Holznot
Thanks! It’s possibly I’m misunderstanding, but I believe Puck is a different problem space to the other solutions you’ve mentioned -

Puck enables content teams to produce web pages using existing React components produced by their React developers in a fixed and predictable manor that keeps them within the brand guidelines.

You can’t inject arbitrary blocks and can only interact with components that are defined by your developers.

You can render fully fledged pages or even, in theory, applications.

Regarding content, Puck supports inline editing or pulling in data via an API adaptor (such as from a headless CMS).

We don’t have a rich text field type currently, but I’m not opposed to adding it. (Internally, we’ve added a markdown component to enable some basic formatting and longer form content: https://github.com/measuredco/measuredco-site/blob/02fc908b8...)
Are also best football players and singer barely better than you or an average Joe?
The current auction is part of a sale that has been in the works since 1996. If something untoward is happening, the public eye has had two and a half decades to spot it and correct it. And the eye has been on it; indeed, the mechanics of the sale were revisited and improved ten years ago.

[1] https://en.m.wikipedia.org/wiki/Helium_Privatization_Act_of_...
Do they all use the same IaC (guessing Terraform..) under the hood?
To give a specific example with respect to writing.

Want an article, blog post, or somewhat longer customer-facing material. So long as I know something about the topic and know where to go to get more information (maybe from you!) I'm happy to quote a fixed rate (+/- word count requirements). I have a very well-calibrated sense for how long this sort of thing takes and I'll put in some language about review cycles, etc.

If you're a law firm that needs an expert witness report, I'll almost certainly charge an hourly rate (which is what the law firm likely expects anyway).
The Ukrainians carried guns to prevent Russians from taking over their country.
Google Nest Cameras get a 25%-33% subscription price hike
I don't think that helps much unfortunately. That's a java.lang.System property (i.e. a config value set within one JVM/app) as opposed to an android.os.SystemProperties OS property (globally configurable on the device via adb). Reconfiguring the former requires modifying the app itself AFAICT.

That's useful for automated testing (which appears to be why they've added it) or for toggling settings between debug/prod builds, but not so much if you want to globally trust a CA certificate on your device. Of course, if you know a way to externally set such a property so that it applies to every app, that would indeed work great, and I'd love to hear about it!

(I'm the author btw, and I don't see any such reply on Twitter? Classic 2023 Twitter ofc)
> This is a solved problem

Sure, but the solution that makes it a “solved problem” is—exactly—what is used now.

> How to you buy a car from someone?

Governments make publicly available title records by VIN for cars. If you are financing a car, the financer will probably insist on verifying it just as the person financing your home purchase will want similar verification.

If you aren't financing it (more likely with cars than real estate) maybe you won't do any verification first, accept a pink slip or deed at face value, and file the required paperwork with the government to record the transfer, accepting more risk.

EDIT: But even if you are doing it without financing, the risk profile is different: an expensive car is a cheap plot of land, which makes the opportunity for profit from fraudulently selling real estate to people who are willing not to independently verify title a lot greater per act than with cars. There's a reason that the saying is “If you believe that, I've got a bridge to sell you.” and not “... a car to sell you.”
The major difference here is that they are not making a directly competing product to Go, Linux, etc. I find the word "leeching" appropriate because here, it's not simply someone building on Terraform to sell something else, they are selling a direct competitor to hashicorp's products.
Read the actual words that it actually says. Sites can pay Google to get a profile of you, based on your browsing history, sent to them when you visit their website. Who's keeping anything local?
I created an account and if I do `ssh <name>@pgs.sh help` then I get `you do not have access to this service`?
I could buy a similar argument for directories: you will almost never see a C project with sources in subdirectories of the top-level source directory -- this is because of the recursive Makefiles which earned quite a bit of a somewhat justifiable hate.

But I don't think compilation times explain the size of the source files. This hasn't been a problem for such a long time that I cannot even remember when it could have possibly been a problem.

I had seen the reverse problem, but not with C... rather with Python source files. The older parser used to be very bad and would start using too much memory if the source file was in the thousands of LOC. I had to witness this firsthand with SWIG-generated Python bindings. I don't remember this kind of problem with C compilers / other utilities though.
I know and I use instances to train, but it would be a heavy improvement if all I need to do is select huggingface datasets and click train and get a model I could test in playground.
I'd like to think you're in the minority since everyone in my vegetarian/vegan crowd hates or is neutral to meat-looking/tasting plant food. Of course, it may just be selection bias on my side.
The use of whitespace in Python was controversial 20+ years ago. These days it seems like no big deal.

The only annoyance is when copy-and-pasting code from one place to another, the indentation can get screwed up, which is a small annoyance.

But other than that, this seems like an argument that was settled 20 years ago.
It actually could be interesting to add tiptap for collaboration!
Great question! It's going to feel very similar but under-the-hood we do not store any files on our SSH service's VM. We use golang's crypto/ssh library to intercept any files being uploaded and instead send them to our object storage service (minio atm).
I'm sorry, I can't really debate with a reductionist claim that everything is 100% fucked when it's readily apparent that some threat actors are still being stopped.

For what it's worth, I'm not disagreeing with your points about needing drastic, systemic improvements in how we handle security.
Updates and the updating process are fraught with problems. Adding a requirement for updates to occur can compound those problems.

Some updates deprecate code. If that code is needed for critical functionality the update renders the device useless for that application.

Updates require some level of connectivity. It is becoming increasingly more common to insulate an IoT device from the Internet. Either through a VPN, an internal firewalled network, or completely disconnected. This is at odds with an IoT "requirement" to update equipment.

Updates require downtime. When do updates occur? How often? Can they be scheduled? If I have several IoT devices from the same manufacturer can I aggregate updates with an intermediate software package which then controls deployment?

How are updates tested? Are the original requirements from the initial manufacturing process kept or does this change over time and result in a broken IoT device.
Thanks for the pointer. I will check it out.
That is pretty cheap for a sofa. Here is what spending a similar amount in 1970 would have gotten you:

https://christmas.musetechnical.com/ShowCatalogPage/1970-Sea...

That would have been regarded a a cheap sofa at the time, and would have set you back $379. Average salary now vs then is 5x so equivalent price would be $1895. Your sofa probably looks nicer but the Sears one has a proper hardwood frame.
"VidAngel covers the requirements for copyright infringement and cites all relevant previous cases
"

It's a streaming case against a single plaintiff, a lot of previous cases are not going to be relevant.

"Are you aware of any case law that finds otherwise?"

I'm aware how courts tend to view these sorts of things in general. For example I'm aware of the concept of contributory infringement, here's one you may want to read that covers copyright contributory infringement: https://www.law.cornell.edu/wex/contributory_infringement#:~....
The qwerty came from idiots.
Even though you're being downvoted I do agree that this should've been squashed (I don't see any other problems here, if that's not it).

I've made sure via repo config that only squash commits are enabled from now on, so this will not happen again. Thanks for the feedback!
They are (or will soon), and that will create massive problems for stability of society at large (which is why government will have to intervene).
It would be trivial to at least continue the standards set by the terraform project. Now there are commits messing with `internal/backend` that breaks tests with the commit message "more".

Someone is going to hit this with `git bisect` and it wont be their lucky day.
Having Firefox as default browser is a bad default for a Linux distro? Well, okay, I guess I'm getting old. Anyway, that was the point where I finished reading.
I wrote elsewhere, but a standard/compatible requirement for a rolled up management dashboard. https://news.ycombinator.com/item?id=37395102

I dont want 30 semi/unmaintained apps to manage each manufacturers security settings.
Most non-technical users that I know don't actively update their phones and push back when I tell them that they need to do so faster than the automatic process because of an actively exploited vulnerability.
Ask HN: Are There wide scale Internet disruptions today?
I'm experiencing it, my neighbors works but it's very slow, mine I can sometimes get download but no upload, and there's a lot of reports on Twitter but I'm not certain if that's just their ISP or a bigger backbone affecting multiple providers.
Heh. I recall their demos on the Amiga.
Would this fall under SLAPP or whatever where you're allowed to recover like 3x damages/costs?
The browser that shows ads on its starting page? The browser that comes with "Pocket", that you can kinda hide but never turn off completely?
Yes, a lot. All those zillion shell scripts which run the IT these days use it whenever they need to get to the Internet (surprisingly, it is much more common than wget(1), which in fact does more or less the same).

And, of course, everybody and their dog uses libcurl, directly or through some bindings to their programming language.
>Facing that alarming state of affairs, defenders of Nelson, Simmons, and Simonsohn have put together a GoFundMe to help the researchers raise the conceivably hundreds of thousands of dollars that will be needed to defend themselves in court.

I do wonder why Harvard doesn't pay for their defense, as they commissioned the study and presumably would like the results to stand, and if those who conducted the study are facing a lawsuit like this, surely you could argue it would hurt Harvard in some way?
Right now, we are able to provide all pico services for free. Most of them have been running for a year+ without much need to charge.

This post is really trying to see how interested people are in a service like pgs. If there's demand, we will figure out a way to charge users based on usage (e.g. bandwidth, storage, etc.).
> regulation like this would make it harder for manufacturers who don't have the market power to lean on their suppliers to provide security patches.

Thought question (I’m asking, I don’t know the “answer”):

Today, many of these devices are marketed and sold by a company that has little to no involvement in the creation of the firmware or software, besides maybe sending over an image of their logo to be rolled into some turnkey “app.” Would we actually be better off if companies couldn’t really afford to basically dropship some sketchy white-label Chinese product, and instead could only sell a product here if they were confident they (acting alone) would be fully capable of supporting and updating it for a reasonable lifetime? Yes, it would raise the barrier to entry above basically the floor where it is today, but I don’t imagine there is a way to have it both ways.
Restrictions of civil liberties in times of crisis aren’t new, see nearly every war.

There’s a very significant difference between “the coming global lockdown” and global lockdowns have happened and might happen again under the right circumstances.

There is no gaslighting, a term massively overused and often wrongly, in questioning and pointing out the paranoia in the former statement.

The person I was replying to seems to have a very dim view of the current and future. They reference the increase in “deaths of despair” and I think that online negativity only provide further fuel.
You thought they were using a DNS-based as filter with molecules?
This boils down the Right to Repair and Maintain.

I always advise my friends and relatives to NOT buy smart appliances. The doom scenario is buying a $20k furnace that becomes useless. Imagine a scenario where you need an app (that's never updated) to adjust your house temperature. Or requiring people run insecure wireless protocols to control it.

Appliances like this need to operate over an open control protocol, where the smart/internet bit is physically replaceable. Dropping $200 every 5-7 years for a new Furnace smart attachment is reasonable price, dropping $20k is not.
Show HN: TalkForm AI – open source conversational forms
High-quality comment. Thanks very much! I'll read your filing and think about it. But also, it's a great example of impactful public FCC commentary. I hope your work inspires others to make their mark in the record.
Currently it is in closed beta. If you want to get an invite, join our IRC channel #pico.sh @ libera.chat and we will send you an invite.
They are not shipping the crack. They are shipping their own binary that has been modified by the crack.
AWS probably doesn't care much for it being closed either. But the benefit of being open is that folks can investigate, report and fix bugs. For example, at Spacelift we found a fascinating corner case where an RDS DB could be dropped if the call to get its details resulted in a transient API error. We wouldn't be able to do it if the code wasn't open. I also believe that the AWS provider in particular gets quite a bit of attention from the community outside Hashi and AWS.
Ennigaldi-Nanna's Museum
You might enjoy this about controlling a river using Tex and postscript

http://sdh33b.blogspot.com/2008/07/icfp-contest-2008.html?m=...
It was a voluntary whole-body MRI. This was my out of pocket expense and the provider’s revenue. No insurance.
The squash merge is not going to solve the lack of proper commit messages and the fact that things are breaking the test suite left, and right.

Figuring out bugs with `git bisect` is not going to be a fun endeavour for people trying to understand incompatible changes.
So to preface this, my spouse and I are trying for our first kid so I'm not a parent yet, but I've been reading a lot and talking to friends who are parents.

> If the life they are coming to is already bad, financially, legged behind from others in many ways, or any other, that's selfish. Forcing someone to terrible start without their consent.
>
> Parent should first make sure they are good to bring someone else and not to give a disadvantage start, playing gamble with life who did not ask.

Literally every aspect of raising a kid is a gamble, but there are degrees to these things. What counts as a "disadvantage" isn't always clear, let alone the degree to which it is actually harmful. Making a few mistakes or not doing things perfectly is probably fine. There is a huge problem with pregnancy and parenthood where controlled studies can't be done for ethical reasons, the number of confounding variables is about as extreme as it can get, and the outcomes you're measuring often aren't even well defined (what does it mean to have succeeded as a parent? What does it mean for someone to have a happy life?).

It's important to try to make your kids have a happy life, but there's a lot of disagreement on how exactly to do that. One factor that seems to have a huge effect is having parents who express their love for their kids and spend time with them. It's important for parents to take care of themselves and their relationship with their partner. One part of that is not burning yourself out trying to hyper-optimize things.
> or shipping an entire browser per app. Instead, one ships the app to the browser.

Yes. Instead you're shipping the entire app, including the whole graphical framework, with every app.

To quote Figma, "Pulling this off was really hard; we’ve basically ended up building a browser inside a browser." https://www.figma.com/blog/building-a-professional-design-to...

Are you sure this is what you want?
Electric flights are coming to Denmark
Fair point, I think we can fix that. Thanks for highlighting that.
Well... I don't think closing all Emacs windows terminates Emacs server... or does it? If not, then only the first start takes time, subsequent starts don't even execute the init file, or do they?
Optimizing a Three-Way Merge
I've come to the conclusion that the only way to convince these people that voting machines are a bad idea is to actually engage in election manipulation and then uncover it after the election has already been accepted. Consequences are the only thing they understand.
There's probably an even stronger claim. It is not that Razor is not making things worse, rather a release from a reputable group is a strong indication that it works and that it will continue to do so many years in the future after activation servers are long gone/DRM methods are deprecated/etc. Quality and reliability is probably the reason why Microsoft used DeepzOne's Sound Forge [1] and Turner Classic Movies used subtitles from Karagarga [2] :-)

[1] https://boingboing.net/2006/07/19/windows-xp-sounds-cr.html
[2] https://torrentfreak.com/turner-classic-movies-airs-a-film-w...
Mentra aims to match neurodivergent jobseekers with jobs
You're the lawyer guy? What statutory authority are you drawing on that you believe allows you, the FCC, to regulate this stuff?

Thanks!
Commit messages like "more", "rollback", "missed that" are not really what you expect from such an organization, so, yeah, that should've been squashed with a descriptive and useful commit message. My repos look like this but… I'm not a professional developer.
How does the merge setting solve the complete lack of any useful information in the pull request?
Actually, the existence of the reserve was not depressing the market. The sell off of the reserve, which was mandated in 1996 and began in 2005, was depressing the market. The sale was modified in 2013 to try to relieve the market flooding issue. The present auction is the final piece of the sale.