skysight-inc/HackerNews huggingface dataset:
So to double check my understanding of this article and the linked one that led to it[1], the issue is:

1. the TPM does not require a password to get the decryption keys

2. bootup decryption passwords are checked by code, before asking (using?) the TPM's data (passwordless, because the bootup code is trusted)

3. exhausting multiple layers of retries causes ^ part 2's code to accidentally get/use the decryption data from the TPM

And assuming that's correct....

WTF

Isn't that stupidly insecure design, because even with trusted-boot checks it's probably trivially bypassed with hardware access (edit: like cutting traces)? Why even offer a bootup password if that's how it's implemented?

Like... at the absolute minimum, a sane design would not completely trust the TPM. Combine the TPM's key with the password to get the real key. No additional steps for users, and it eliminates all TPM-only attacks (subject to your password strength... but currently that is 0 so anything is an improvement).

[1]: https://hmarco.org/bugs/CVE-2016-4484/CVE-2016-4484_cryptset...
I'm not clear on what you're referring to. What's the organization and what's the relevance of them being local news?
We're the alums of Amazon, seasoned trailblazers, who've successfully taken ideas from PPTs to acquisitions. Our roadmap for the next 5 years? Build and scale a dozen companies. But we need you!

Are you a superstar? Are you ready to conceive, validate, and launch new products? Prufrock Ventures is your launchpad. We're hiring Engineers for our companies in addition to our own venture studio.

At Prufrock, we pool resources across design, marketing, engineering, and business development to bring your business dreams to life.

Here's a list of our OPEN Engineering AND Entrepreneur In Residence roles:

Venture Studio | San Francisco | Remote | Entrepreneur in Residence (Venture Studio) • Apply here: https://rb.gy/3t5bt

Stealth | Austin | Hybrid (ONSITE / WFH)|Senior Software Engineer (Founding Team) • Apply here: https://rb.gy/q7kr9

Magnolia | Seattle | Remote (prefer local) | Senior Software Engineer (Founding Team) • Apply here: https://rb.gy/0awxe

Upside | New York | Hybrid (ONSITE / WFH)| Head of Engineering (Founding Team) • Apply here: https://rb.gy/tx4my
Canada is a fully democratic country where citizens are allowed to vote for whomever they see fit. They have the politicians they voted for.
he turned over the beads and all was forgiven
PixLab (https://pixlab.io) & FACEIO (https://faceio.net) | Full-or-part-time | Remote | Computer Vision / Full stack Engineers |

PixLab, a leading provider of Machine Vision, Face Recognition & Media Processing APIs is looking for:

* Embedded C & Computer Vision engineer(s) to work on the SOD (https://sod.pixlab.io), embedded computer vision library.

* Senior Python engineer with proficiency in PyTorch to work on FACEIO (https://faceio.net), our facial authentication web framework for web sites & apps.

* C++ developer with ML expertise to work on the port of Tiny-Dream (https://pixlab.io/tiny-dream), our embedded Stable Diffusion C++ library from ncnn to ggml.

* React/Vue JS Web developer(s) with expertise in fabric.js to work on a brand new, web based photo editing software backed by generative AI.

Reach out to Vincent via contact AT pixlab.io with your resume if interested.
I’ve been wondering why doesn’t google use its own elevation and traffic data? There are no privacy issues with the data they already make publicly available. Prioritizing flatter and more pleasant routes over shorter ones couldn’t be more complicated than adjusting a few variables, could it?
What would really, really help is for drivers to not assault cyclists. Don't throw drinks. Don't run over cyclists. Simple as.
Google Chrome Store actually pretty good at detecting malware and spyware.

Also forbids code downloading from external sources.

So downloading from the store should be more secure.
It's not reinvented, it's iterated, knowingly or not. And, you can only move towards optimization by knowing your derivative.
Are you referring to Post Media?
I am disassembling electronic circuit boards and make logics for cardboard birds out of them.
Looks to me that right from the start the study has a fatal flaw and it's clearly biased.

Just looking at their channel selection is clear that they consider extremist only some forms extremism. Particularly those often considered as aligned with right wing politics.

From the Ledwich and Zaitsev paper they reference only the "white identitarian", "anti-sjw" and "men rights activism" categories are selected. But there are more categories that could be considered extremist at a glance like "revolutionary" and "anti-whiteness".

Other categories in Ledwich and Zaitsev's paper: Conspiracy, Libertarian, Anti-SJW, Social Justice, White Identitarian, Partisan Left, Partisan Right, Anti-theist, Religious Conservative, Socialist (Anti-Capitalist), Revolutionary, Provocateur, MRA (Mens Rights Activist), Missing Link Media, State Funded Channels, Anti-Whiteness. Some channels in other categories could be considered extremist but would require a nuanced analysis.

About the other lists or what actual channels they looked into I can't really say because I can't seem to find the actual list they used. If someone has the full list and categories they used please link it.

While it could be possible to analyze the behavior of extremism using only right leaning extremism, it is possible that this pattern does not apply to other forms or ideologies.
Are you willing to go to jail after someone hacks into your phone and uploads CSAM to it which triggers this detection mechanism?
I’d always heard it was to try to minimize rivers in text. I don’t see that mentioned.

https://en.m.wikipedia.org/wiki/River_(typography)
Maybe discoverability? If you can’t google “major event” to find news, you’ll wind up just going to big-news-site.com and searching there.
This is extremely short sighted.
License the name to her, talk to her.
I've always been annoyed by the way html treats whitespace. Having more space between sentences is so much more readable.
For those like feeling deja vu, there was some discussion 10 days ago, but NOT above HN's general "significant discussion" threshold:

<https://news.ycombinator.com/item?id=37268852>

(Based on NY Times coverage.)
Most law enforcement is "above" local jurisdiction practically speaking.

Police are local militias with a near-military supply of weapons, technology, and surveillance.

Cities often seek judgement or ways to control law enforcement but police unions and silent strikes render their attempts futile.

If your city had George Floyd protests, you're likely aware of these silent strikes. The police simply stop doing their job and allow crime and lawlessness.

Without the threat of a national military coming down on them, local LE behaves like a mafia.
Large media outlets (Rogers, Bell) are the ones who lobbied for this bill. And they do benefit from it, because smaller, independent outlets are the ones that get the most exposure from social media.
Explosive reactive armor for bicycles, that way we can both lose.
Related question - if you own a domain and then afterwards, someone comes along and starts a company with that name (and presumably trademarks their company name) do they have recourse to seize your domain?
This can only work if every government does it. Google imposes a tax on everyone (advertising) so it is only fair that others impose a tax on google
Thanks! We're a small team, so it doesn't really matter which role you apply for.
OSMAnd + Brouter is really the gold standard for bike routing for me, though the Brouter Android app could certainly use some polish (it barely looks like an Android 1.0 app).

If you just want to try the routing, there's brouter-web too ;)
There's a guy who does youtube videos on Paracord braids and the like. Excellent instructions, but I got kind of a sexual vibe off of it between the music and the way he handled the paracord. All the videos show are his hands and the cord, nothing weird at all. Always thought something was off about it and then found out he's big into restraint or whatever you call the bdsm stuff where people get tied up. Made a lot of sense after that. Still love his videos.
A 6502 takes 7 cycles to execute the reset vector and run user code.

Of course the definition of "usable" work can be argued over but even a C64 released in the 80s will run your code in less then 10us

1ms is an enormous amount of time. I'm really curious why you would think otherwise
EmbedElite Meets Semantic Kernel: Improving Context Retrieval for Developers
To use a cliche, the map is not the territory.
It's not communism, it's a new form of feudalism.
Would there be any interesting science to be had if we sent something to orbit Jupiter that could wait for, detect, and get us closer readings/views of such impacts?
How can it be corruption when it's all because of just "a few bad apples"? (Quoth my thin blue line next door neighbor.) To that world view, nothing wrong is systemic; it's all down to individuals whose behavior is not considered part of the whole.

Incidentally, I'm not sure he's familiar with the second half of the idiom ("spoils the whole bunch").
Similarly, a list of firefox's "about:" URLs can be found in "about:about".
> The widespread assumption that Google collects all data all the time and uses it for everything is ridiculous.

Maybe they fail to use it competently but it definitely collects a lot of data and attempting to stop it results in punitive reactions and disabling of features not needing it - and repeated badgering to permit Google to collect data again.

Google also collects data that I was initially unaware that it is collecting.
Japan marks 100 years since Great Kanto Earthquake
U.S. Air Force selects fast microreactor for nuclear power pilot
Doesn't feel like an adequate take on voter/government outcomes anymore.
Then get into your head that Tesla engineers use the fact that the entire fleet has video and telemetry data in order to fine tune the use of airbags for the exact opposite purpose: to reduce injury caused by both excessive and insufficient airbag deployment.
Germany charges 98-year-old Nazi guard for murder complicity
Octopux.
I bought an SFP+ thingy three years ago and my sales consultant is a darling, we chat at least once a quarter. I haven’t bought anything since, but her kid recently graduated!!
It's not clear to me how this is "taking an L" in any way.

The only people I know who think getting news from fucking facebook of all places are boomers caught up in the doomscrolling dopamine treadmill who are also caught up in the milquetoast Canadian version of MAGA.

Forcing people to go outside their shitty echo chambers for news seems like an astronomical win.
In theory, communism can reject the concept of private property, but in practice, all property ownership is "private", as any finite quantity of matter and space must necessarily be controlled by someone in particular at the exclusion of everyone else if it is to be used by anyone at all. So the practical differences are merely aesthetic.
Exactly! Don’t just blame politicians for this. I have had multiple heated arguments with my idiotic compatriots over this one. They don’t get it at all! They just stand on the sidelines and cheer:

“Yay Government! You stand up to those big tech bullies! Boooo Facebook and boooo Google!”
Any time you come across the tired "billionaires are evil" line, you are likely dealing with some sort of political rhetoric instead of an actual argument/position.

As-if there's any practical difference between a billionaire-owned publication and a millionaire-owned publication within this context.

> This is a few rich, mostly billionaire-owned telecom/media companies working as hard as they can to keep out competition.

There's many holes in this particular argument, such as non-billionaire owned publications - are they incapable of astroturfing and gatekeeping? Absolutely not, of course.

I agree, the link tax idea is bad already - we do not need to add cliché talking points into the mix.

As an aside, I personally find it interesting how this mantra started off as "millionaires and billionaires" being evil, until the movement's leader became an overnight millionaire himself. Now, apparently, it's just billionaires that are evil.
https://web.archive.org/web/20230901181858/https://longnow.o...
I read condemnation on this site every day against Europeans/Americans because of things done in the past that we were not a part of.

Yes, a social structure similar to Jim Crow in the USA should be condemned not celebrated as being tolerant or some mythical place. It was not a good culture, it was not kind. Islam only allowed enslavement on non-muslims. Nice 'tolerance'. You shouldn't enslave people, and my people we mean non-believers. As many as 1.25 million white Europeans were enslaved by Islamic slavers. Much tolerance, much beauty.
I'm open to having a monthly thread about this but it shouldn't be on the first of the month - that's a traffic jam of monthliness because there are 3 (already too many!) Who Is Hiring threads on those days. As a result, these threads aren't really achieving liftoff: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

If that were as well as they could do, we'd have to call it off, but there should be more potential than that so I'd be willing to put some support into it, at least for one or two tries.

Here's one option: why don't you try the 3rd Saturday of each month? A weekend day should bias things in the direction of side projects and curiosities, which is probably more interesting (in HN's sense). If you do that, email hn@ycombinator.com and we'll manually place it on the front page, see how it does, and maybe take it from there.
At a certain point the difference between reasoning and producing reasonable text, disappears.

2 + 2 = 4

2 + 2 = 4

Which of the above lines was generated by an LLM, and which was manually written by a human?
Counterpoint: That would just mean taxpayers would pay more for police gross negligence (which is already a problem).
I was little confused after reading the article exactly how this would work. I checked out the actual regulations and found this formula and explanation:

> (Intermediary global revenue) × (Canadian share of global GDP [≈2%]) × (Contribution rate [4%])

Proxy for “Canadian revenue”
Intermediary global revenue
This figure refers to the annual global revenue of a digital news intermediary. It excludes other unrelated revenues from the company operating the intermediary.

Doesn't seem like a very fair or accurate way to implement it regardless of whether this is a good idea or not.
The article title is very misleading. This isn't bypassing FDE in any way. It's just getting a root shell on a machine you have physical access to with a particular boot configuration.

Clever? Yes. But no encryption is bypassed.

Most systems will only be listening to PCR 7 anyway, so a similar attack could be done by loading your own custom bootloader, or possibly reading messages on the SPI bus when booting. This is just a nice trick that's easier/faster.

There is a balance of convenience versus security and this could be prevented easily by disabling recovery shell or registering more PCRS (with correct boot setup), but would be much more annoying to remotely administer since you could get failure states where the TPM won't release the keys in a variety of situations.

Ultimately TPM-only unlock is a significant increase in security vs unsophisticated attackers and probably fine for 99% of people, but isn't something to rely on if you are concerned about sophisticated attackers.

Even with perfect PCR setup and enrolling only custom keys in UEFI, a running machine is still vulnerable. Cold boot or DMA attacks (Thunderbolt or PCI) are just a few that come to mind. These sound extremely sophisticated but are easily done even with hobbyist equipment. Any running machine with currently unlocked disks should be assumed to be possible to compromise with physical access.

If interested in Linux boot chain Poettering has a good read: https://0pointer.net/blog/brave-new-trusted-boot-world.html

There are a lot of interesting talks around Linux boot security in the upcoming All Systems Go! conference: https://all-systems-go.io/

Microsoft has info regarding boot security in BitLocker Countermeasures: https://learn.microsoft.com/en-us/windows/security/operating...
During the Cold War, Soviet states and the socialist economic system they had were propagandized in America as "the government can take your stuff at any time because COMMUNISM". This was aided by the fact that, in practice, the Soviets could and did do that. However, it was not at all a unique feature of socialism or communism. Police states don't care about who nominally owns the economy, they care about what can be looted from it.

Capitalism has no defense mechanisms against unwarranted seizure of property. Private ownership is a precursor to capitalism, not a byproduct of it. Furthermore, there are plenty of ways by which capitalist entities can gain government-like powers, if not totally supplant the government[0]. Concentration of wealth is a problem whether or not the person who owns the wealth claims to own it for themselves or in the name of the working class.

The way that you prevent the government[1] from stealing your stuff is to make it inconvenient for them to do so. In the US, we have presumption of innocence, right to due process, and so on. These are constitutional rights that the government broadly respects. If they regularly didn't, you'd see brain drain as people and businesses with the means to do so would escape the country. Those without such means would begin economically sabotaging the country. However, these are blunt instruments whose use entails personal cost, so people don't use them right away. The US can therefore get away with ignoring its own constitutional obligations some of the time, and in this case, that's how they get away with civil forfeiture.

Think of it like this: when Apple or Google start screwing over developers, or Reddit or Twitter start screwing over users, we don't all immediately jump ship, but some do. If they continue doing this, and they exceed a particular threshold of bullshit, they continue losing people faster than they gain. This creates a feedback loop of stupider and stupider tactics pissing off more and more people until the platform collapses.

Countries work in similar ways.

[0] The basic idea of Rothbardian ancap economics is that we should deliberately encourage this. The idea is that this would supposedly lead to competition for governance. Except this wouldn't actually happen because competition is a byproduct of capitalism, not an essential property of it.

[1] or government-like entities
always do 2 valuable tasks a day. Lines of code is not important, change it to steps to goal that you done
Correction: Canada is a country with a small number of large cities that determine the national government. There are whole regions of the country that have no representative voice within the governing parties.
Why Some Seats at Elite Colleges Only Go to Prep School Students
> Without any backups floating around out there this stuff is gone forever

I think part of the problem is that most backup efforts result in lawsuits. Related, I wonder how much the data stores, like those that OpenAI used, have preserved, and I wonder how much they will purge from their servers, to be lost forever, as the lawsuits increase.

For Youtube, it also has compression rot. It's not a storage solution, as I've learned. All the videos I uploaded have slowly reduced in resolution, bitrate, and quality, over the years. Those that are more than a decade old have become a blurry mess that I can barely see, at a fraction of the resolution. I can't blame them. They don't really have views, so they're a money sink.
I'm building a publicly accessible Matrix server, with community features.

[0] - https://shpong.com
I tell people OsmAnd is a swiss army knife that does everything for power users (the cyclists or hikers or drivers who find it really important to do a few specific things that most apps can't do) whereas Organic Maps is the app I actually recommend to family and friends as soon as I know that there's decent address coverage in their area (it's OSM only, so if an address POI doesn't exist in OSM it isn't searchable in OM. But volunteers and everyday users are adding new addresses all the time.)
Canada O Canada. When will thou learn. Innovation has to be created in the country. That is the only way out of the mess you find yourself in. And it will only get worse.
There isn't really any societal upside with smoking. It's a real net negative for the vast majority of users, financially and healthwise. Maybe smokers should switch to coffee for their high, a drug with no major downsides for most people.
OpenAI: No way for teachers to figure out if students are using ChatGPT to cheat
He is not asking anything. He is making a statement. When someone says “that’s why A, and also why B”, they’re making a statement, not asking a question just because the word “why” appears. The lack of a question mark is also a clue.
Take me down to the Kracken city

Where the seagrass's green and the girls are eight-armed.

</GnR>
Location: Portland, Oregon

Remote:Onsite/hybrid/remote OK

Willing to relocate:Yes

Technologies:Python, AWS, ETL, Data Integration, Data Transformation, Data Modeling

Résumé/CV:https://www.linkedin.com/in/bmond

Email:vaskar.cse@gmail.com
They don't mention it here, but I think they might on a different post? Rivers are going to show up more in a monospace font (which your link points out), so that would make sense. With modern fonts it makes sense to be putting the spaces in after a sentence stops for readability though. Microsoft word allows for manipulating spacing anywhere there are still rivers.
> Robbery on the other hand is by definition a violent crime, the threat of violence is what distinguishes it from other forms of theft or larceny.

This is exactly it for me.

When I first read that the TSA would report you to the DEA for carrying large sums of cash into an airport, and the DEA would intercept you and seize it, I’ve been referring to it as armed robbery.

When the DEA asks you to hand over the $10k in your backpack, they’re doing it under threat of violence. It’s armed robbery, they just haven’t “drawn their gun yet.”

Try sticking to “I’m sorry sir, you can not have my money” and you’ll quickly see what the full weight of the U.S. Government looks like when escalated against you.

From the time they decided they wanted your money, it was theirs.
General data from the US for burglary depends on the source, yea.

If you look at victim data it's roughly it's 3 million burglaries per year, about 1/3 of which are home invasions. And about 1/4 of those (so 1/12 of total) are also violent crimes where the resident is injured.

But then when it comes time to report crime stats some stuff gets partitioned off into other buckets (I guess to avoid double counting? Idk). So e.g. some sources will take those 250k assaults-during-burglary and not count them as burglaries.

It gets really confusing really fast.
That's super interesting - it's a lot more than I would have thought it is. Metal is metal, right? Didn't think the difference would be so large.
I do not think Twitter is violating the Constitution unless we are talking about some kind of state actor doctrine vis a vis misinformation censorship under previous ownership.

I do not think there are any violations of intellectual property law given that there is surely a waiver of ownership of posts in the TOS.

I, of course, do not have the kind of free time required to do something like engage with Twitter, and accordingly I have no account, cannot post, and have not agreed to the TOS.

I think you have misconstrued my post, but that’s ok.
Which is good, since votes shouldn't be worth more depending on where you live.