skysight-inc/HackerNews huggingface dataset:
You know how I never get phished? I never answer any call or sms asking anything, and a link in a text message is ALWAYS a major red flag. I know everyone is talking about the MFA, but the entry point was the employees phone numbers, how they got that in the first place? Especially from the article the attacker knew the internals of this company..

As for the MFA, google should have the on demand peer-peer sync rather than cloud save, for example, a new device is added, then your Google account is used to link between these new device and existing device, click sync and you will be asked on your old device that a new device is requesting bla bla would you allow it? And obviously nothing saved in the cloud, just a peer-peer sync and google is a connection broker.
I Think “Law 3.0” Is OK
I thought there were LFP chemistries with virtually unlimited recharge cycles. That's what Jeffrey Dahm stated back when Tesla was bragging about the million mile range battery pack.

With Sodium Ion entering mass production, and whatever mishmash of solid state and sulfur techs hit mainstream, I think batteries will be the way to go. There's always flywheels too.
It's like those optical illusions that you can't stop seeing even through you know your eyes are lying to you. Our brains are just wired to leave us vulnerable to certain cognitive biases and errors and while we can try to increase our awareness of those vulnerabilities we can't get rid of them.

To make it worse, scammers and corporations spend massive amounts of time/money researching how to best exploit those weaknesses and so the moment our guard is down any one of us could fall for one of their traps. We're all basically one bad day away from being suckered into losing money on something. Nobody can be hypervigilant all the time and a person like Newton probably had a lot on his mind.
> We want everything faster, in more comfort, to last longer, to be cheaper, to be more automated, to me more grandiose, to be more precise, to be more convenient.

Perhaps some of these should be reevaluated since it appear clear that their cost means less duration as a species.
Looks great, but I'm bashing my head trying to figure out what the r means in kr8s?
Note that exceptions to the correlation has both false positives and false negatives.

e.g. On opposite side of people with bad credit who got hit by unavoidable circumstances, there are people like my partner who have limited credit score upside because they don’t use much credit. My partner has a mortgage with me, but other than that, she doesn’t have any debt and doesn’t use credit cards (other than the prepaid variety which pull directly from bank accounts and don’t contribute to credit scores.)
Feel free to start your own competition where people are awarded money for a system that correctly answers some set of questions, divided by the amount of storage that system needs.

Sounds like a tough competition to run objectively, not that that makes it less worth doing, but I can see why the parameters were chosen as they were in 2006.
This would almost certainly be it. Calling someone to record them and using their voice later to impersonate them was done even before deep-fake voices were a concept. With the tools available now, even a short call + the grainy connection of a phone voice line would be more than enough to make a simulated voice work.
I have an idea if you want to code it. You know how we can drop the vowels from sentences and still understand the sentence? What if we do that on the first stage? May not work for every case so have to identify. Worse comes to worst, use full word. Probably not saving much though. Worth a try.
Look at it like this:

- Fine tuning: Difficult, time-consuming, slow, takes time to add new information, costs a lot more.

- RAG: Can be free if you use free options like Chrome, Weaviate, or Postgres with Vector Plugin. Really fast. Once you set it up, you just need to upload a document, and it's available for GPT to answer with.

I'm using RAG for a client right now, and it was a breeze. Really easy, especially if you use something like Langchain. Compared to fine-tuning, it's a lot easier, cheaper, and faster...
Inarticulable Knowledge
Maybe commodity servers with integrated and probably never used graphics capabilities that no one would actually describe as a GPU?
Did you arrive in a time machine from 2021? We all got covid shots and boosters and then covid. They didn't do anything and the only think people can come up with is to keep getting shots. It's not contrarian. Doing something over and over again that doesn't work is crazy. By this point everyone's had so much of this rammed down their throats that they can make a judgement themselves. Don't talk down to someone who has made a different judgement than you, that's supported by overwhelming evidence and experience.
Thanks! It grew out of an old side project. Been full time on it since December.
Employees are only human. Even smart, savvy, well-trained employees can be fooled by good social engineering every once in a while.

The key to good security is layering. Attackers should need to break through multiple layers in order to get access to critical systems.

Compromising one employee's account should have granted them only limited access. The fact that this attack enabled them to get access to all of that employee's MFA tokens sounds like indeed the right thing to focus on.
> Are all of these folks more susceptible to bribes and blackmail?

Yes? I expect I’m more susceptible to bribes and blackmail than I would be if I were independently wealthy and mortgage-free.

Not that I want to be discriminated against on those grounds.
Definitely, sometimes they'll have a case number or agent id you can use to get back to them, but there are cases where you have to assume if it's important to them they'll continue to nag or reach out on another channel.

I have had at least one situation where I spent a while trying to get back to a quite convincing/legitimate sounding caller this way, where, as I escalated through support people it became increasingly clear that the initial call had been a high quality scam, and not in fact a real person from the bank.
Thanks for the reply! What's expecting one.

Since you might have you delete the reply anyway, can I get a candid answer on why hardware 2FA tokens weren't a part of the default workflow before the incident? Was it concerns about the cost, the recovery modes, or was it just the trust in the existing approach?
I got teletext (system for transmitting data/subtitles alongside a TV signal) vibes from it. I wonder how it's encoded, since it seems to come out with the digital audio stream regardless of what's playing it.
Thanks for all this insight, this is why HN rules. What is your impression of law enforcement, everyone claims to reach out after an attack, but I've never seen follow up of sucessful law enforcement activity resulting in arrests or prosecution. Thanks again.
Well, no, the article was not written in 1969. The year of events described is irrelevant.
How Voicemy.ai Is Exploring AI’s Limits with Voice Cloning
I'm not sure why you're so suspicious of my banal vacation story. Here is the dull chain of events:

* We return late to the MGM self park one night. I was told I could "use my key" to get in/out. Stupidly I put my key into the credit card slot (rather than scan the barcode, as you're meant to) and it eats it.

* We return to the hotel room using my wife's key because we're tired.

* The next morning we decide to use the Grand's pool. I leave everything except the remaining room key and my phone in the safe because we're going to the pool and I would not leave anything poolside that I couldn't tolerate being stolen.

* On making it to the lobby, my wife decides she wants Starbucks. I decide to spend my time attempting to get my key replaced. I therefore turn up to the desk with my remaining room key, my phone, but no driver's license or passport. In Europe this would literally be zero problem, hence my attempt.

* I was able to use a combination of answering numerous questions about my room, my identity, and how much I'd spent on the room to convince them to give me a second key.

* I later returned to the desk with my ID to add parking to my folio.
This is mostly a copy of Levenson's 2009 article, submitted a day ago.

https://news.ycombinator.com/item?id=37493372

https://www.executedtoday.com/2009/03/22/1699-william-chalon...

I found this interesting:

> Newton did not expect as Warden to have to chase crooks; when he found out that was part of the job he wrote a rather whiny letter to the Treasury to see if he could wriggle out of the duty.
Is the COMT gene stuff discussed in "Suggestible You"? I recently learned I have the AA variation and from what I understand so far, it seems like it might be an explanation (or at least part of one) for why I am so sensitive to a number of vitamins and medications. I hadn't heard about the placebo related thing. But anyway, I am interested in continuing to learn more about it (it has been somewhat difficult for me to find digestible information about it online) so might look into that book if it discusses it much at all.
Some background before i explain why your suggestion is "not even wrong". If you can predict the next X bits given previous Y bits of observation you don't need to store the next X bits, the decompressor can just use the same prediction algorithm you just used and write out its predictions without correction. This is the same as general purpose AI at a high level. If you can predict the next X bits given previous Y bits of observation you can make reasoned a decision ("Choose option A now so that the next X bits have a certain outcome").

The above is actually the premise of the competition and the reason it exists. What i've said above is in academic papers in detail by Marcus Hutter et al. who runs this competition. That is lossless compression can be a scorecard of prediction which is the same as AGI.

Now saying "they should just make it lossy" misses the point. Do you know how to turn lossy data into lossless? You store some data everytime you're wrong on your prediction. ie. Store data when you have loss to make it lossy. This is arithmetic coding in a nutshell. You can turn any lossy data into lossless data with arithmetic coding. This will require more data the more loss you have. The lossless requirement gives us a scorecard of how well the lossy prediction worked.

If you ask for this to be lossy compression you throw out that scorecard and bring in an entire amount of subjectivity to this which is unwanted.
One would think it ought to be possible to automate generating these overviews. Or has it been automated and is it being posted with a non-service account because it's partially but not fully automated?
My mother recently started having to deal directly with utility bills and the like and this was some information we impressed very early on. You should never agree to billing or hand over CC/account information in a phone call you didn't initiate. She hasn't run into an issue yet - most utilities, online stores and other entities have call in numbers if you need to resolve a billing dispute. That random company you bought a plumbing valve from has an office somewhere with a secretary that gets a phone call maybe three times a month from customers looking to resolve issues - and Amazon has mostly centralized support for small sellers and has lines you can call to resolve any disputes you have which may forward you to the original sale party but often just resolve the issue directly.

Honestly, the worst experiences are usually with large companies that funnel all customers into massive phone centers - I've probably lost the better part of a week to Comcast over my lifetime.
To me, this looks a lot like Sequin (https://sequin.io), minus the ability to write back in the other direction (but plus open source!).
You can theoretically run untrusted code from customers in a secure sandbox. This is a simpler proposition that letting customers run vms.
https://archive.md/EHz8z
Pursuing fairness at all costs seems dumb to me
Oral tradition has had great utility for people for millennia, and it's very much lossy compression.
One interesting thing is that category theory provides a way to precisely describe a Most General Unifier. It is a example of a coequalizer.

This isn't a really basic and accessible result, but IMO it gives a good flavour of what category theory is suitable for: formally describing constructions we didn't previously have the tools to express precisely.

https://www.sciencedirect.com/science/article/abs/pii/B97801...
This comment reads more poorly to me than the actual blog post. It _should_ be your intention to shift partial blame to Google, and you should own it. It's ridiculous that they make an operation like syncing your MFA keys seem so innocuous. I just changed phones, so I'm just seeing this user flow for the first time, and it is ghastly how they've made it the default path.

Changing things to make it less offensive to someone who was offended really waters down your position.
The trick here is that they aren’t just driving fake streams. They are burying the fake streams in amongst legit streams.

I’m still a little sceptical of this article’s claims, but there is absolutely a problem with fake streams/stream manipulation.
Aseq? I've had good luck with these for a few applications.
It's a lot more consistent and predictable than Javascript.
Reading your free trial pitch reminded me of Jeffrey Gitomer and his book Sales Bible that I read 20+ years ago. Your pitch has similar vibe. As someone else commented, today’s audience may consider the style cringy but very effective once you have the target audience.
A very interesting idea to be sure, but IME the biggest downside (which tbf is mentioned in the article) is the contract. If you have clients with knowledge of and dependency on the schema, you can't change it in a breaking way unless you update all the client's code.

I've tried various patterns in the past like one that just exposes database columns as an API, and this pain point always comes calling and it hurts. Keeping your data model simple and lean as possible is an important part of limiting complexity, which directly correlates with maintainability.

The only pattern/approach that I consistently return to is the Rails pattern (I use Elixir/Phoenix now but same pattern). It is certainly not the most sexy, and having a client be able to graphql exactly what they need can be really helpful, but at least for me it has rarely turned out to be worth the tradeoffs.
notice Greta’s innocent smile lol
> On a rental property, he was underwater on the mortgage at the time of the 2008 crash

What I don't understand is why people worried so much about being underwater. As long as you kept making payments, couldn't you ride it out and still own the house as the market recovers?

> Trashed his credit rating but he never had any need for it, he had enough to buy his own house and car outright.

This feels like it should be considered some kind of fraud.
As I understand it, WASI doesn't break all security, or at least not by default. Here's a document about capabilities-based design:

https://github.com/bytecodealliance/wasmtime/blob/main/docs/...
That seems strange for the business version, considering that one of the intended uses is for planes and ships.
I don't think it was an obsession. It was personal with Chaloner, because Chaloner called Newton a fraud.

Newton was dutiful, honest and smart.
What about a MaskedArray? ndarrays are homogeneous by definition.
I am (genuinely, really asking) curious why you think so. I've got no hand in this, but the skepticism around phishing attacks from this site of all places really surprises me. People like Kevin Mitnick have done more sophisticated phishing with fewer tools. Why wouldn't someone intent on running a social engineering scam use one of the widely available voice faking technologies that are available now? Keep in mind that they're simple enough to use that people are making memes with voices generated from ~5 seconds of voice recordings.
Just be mindful that the US is the only country that has this attitude towards free speech.

Everyone else including Western countries like UK, Australia, Canada etc have a different take. Which is that hate speech is not conducive to a healthy society and that it doesn't lead to tyranny. Whatever that even means in modern discourse.
A downside I didn't see mentioned (it was gestured at with contracts and the mention of backwards compatible schema changes, but not addressed directly) was tight coupling. When you link services with APIs, the downstream changes of a schema migration end at the API boundary. If you are connecting services directly at the database level, the changes will propagate into different services.

That would make me very nervous to ship something like this. You can probably cover a lot of this with views as a backwards compatibility shim, though.
Ask HN: Best way to downgrade Adobe plan?
I have a buddy that signed up for the All Apps Creative Cloud plan but now wants to just pay for the Photography plan. Is there some sort of strategy for doing that without having to pay Adobe’s insane cancellation fee?
Well, he was also a lifelong celibate.
For ABV you'd usually use refractive index, there are low cost non-electronic refractometers, you can also use density. Alcohol doesn't absorb much light so generally not done by UV or IR.
Roger Murdoch has entered the chat
>No need to parse any device trees.

If you just use the UART address that has been passed directly in a register, there's no need to look at the device tree.

If the UART base address was fixed, you'd normally need to load this base address in a register yourself and offset the hardware registers of the UART from it.

Yet, the way it actually is, this non-fixed base address is already in a register; You need to do even less work.
2009.

Levenson's book publish date.

https://www.amazon.com/exec/obidos/ASIN/0151012784/exectoda-...
It's also a reasonable defence against naive keylogging techniques - including shoulder-surfing either directly or eg via security cameras. In some places this can be a pretty big threat.
> it's a little more general, I think, since one common use case for it is to use it on your own process in order to intercept calls to stdlib/OS code from libraries you don't control.

This capability is intrinsic to how ELF linking works. The main application or even any library can interpose a libc function just by defining and exporting a function with the same name, and that definition will be preferentially linked in both the main application and all subsequently loaded dynamic libraries and modules. Your definition can then use dlsym(RTLD_NEXT, "foo") to obtain a function pointer to the next definition, which would normally be libc itself but may be from another library. A running application could actually have several implementations of a function, all proxying calls onward until the terminal (usually libc) implementation.

Basically, the way ELF linking works by default is that the first definition loaded is the preferred global symbol used to satisfy any symbol dependency with that name. It follows that there's normally a singular global symbol table. Though there are features and extensions that can be explicitly used to get different behaviors.

There's nothing magical about LD_PRELOAD within the context of ELF linking. LD_PRELOAD support in the linker (which is the first bit of code the kernel loads on exec(2)) is very simple; all the linker does is load the specified libraries first, even before the main application, so symbols exported therein become the initial and therefore default definition for satisfying subsequent symbol dependencies, including in the main application binary, and even if the main application binary also defines and exports those symbols.

All of this is basically the exact opposite behavior of how PE linking works on Windows, for better and worse--depending on your disposition and problems at hand.

Also note that all of this is different than so-called "weak" symbols, which is a mechanism for achieving one of the same behaviors--overriding another definition--when statically linking. Otherwise, when statically linking, multiple definitions are either an error or it's difficult (i.e. confusing, especially in complex builds) to control when and where one definition is chosen over another.

[1] Though main application symbols aren't usually exported by default, so you need to explicitly mark a definition for export or build the entire main binary with a compiler flag like `-rdynamic`, which is the main binary analog to the `-shared` flag used for building shared libraries. The Python and Perl interpreters, for example, are built with -rdynamic as the interpreter binary itself exports all the implementation symbols required by binary modules, rather than defining them in a separate shared library against which modules explicitly link themselves against at compile time. (This is also why when building Perl, Python, and similar language modules you have to tell the compile-time linker to ignore unresolved symbols.)
I started with reacts own getting started documentation and went on from there.

Out of curiosity if I asked you how would I get started with pandas, numpy or matolotlib how would you respond?
Hey John! Do you have plans to refine or iterate on this design at all? What features would take this aroma picker to the next level?
InstaGraph: Converts text input or URL into knowledge graph and displays
Think of it this way: good at everything, great at this one thing. It takes time and dedication, generally outside work hours.
Ha ha not sure yet, I have only done it from the command line. Still got a lot to learn. Building something like this will be good for that!
Bluesky exploit modules by Jason Parker
I'd have more faith if I saw a lot more effort being expended. It seems like most places are still pretending nothing will change. People are still buying property that regularly floods even while insurance companies are refusing to cover them. States are selling off their clean drinking water to industries that will waste and pollute it. Important infrastructure is left outdated and crumbling. Environmental protections are being rolled back, fracking and drilling continue.

At this rate, it's looking pretty rough.
I really like this approach, but it contains some confusing mistakes. For example, unless I'm very much mistaken, the illustration of the initial object is backwards: https://abuseofnotation.github.io/category-theory-illustrate...
anecdata: for my entire life, I have neber, until about 3 weeks ago, owned a laptop with any type of gpu other than an integrated graphics card built into the motherboard. for most of my life in fact I have never really had any modern or really serviceable hardware, as I've basically inherited all of my compute devices secondhand never had the money to just go out and buy a decent rig (or to even put one together for the matter, perhaps tbst will elucidate the economic sector which I have basic y always occupied. well, not always, as now that I'm homeless, I somehow went even LOWER! )

though it truly does excite me that I finally have something with some type of GeForce branded x graphics device inside of it, now I can finally run local machine learning tasks and not have to cloud it out
Let's say you really find a new, much much better compression algorithm for texts. I do believe that soon new applications will appear that will make use of the whole storage space that existing data storage devices can offer.
This is really cool. My only concern is that the impulsive nature of purchases would lead me not to use this when I need it the most.

I’ve had some luck using budgeting apps - simply putting myself on an allowance of “impulse purchases”. I would love/hate an app that brought back purchases from the past and said “hey, are you still really loving that XYZ you bought in November 2023?” I’m guessing that would reveal some wasted funds… especially if it baked in missed market gains or interest.