skysight-inc/HackerNews huggingface dataset:
Terrapin-Attack Style Vulnerability Likely Exploited for 2 Years
I wanted to share some insights into a security concern that echoes the Terrapin-Attack scenario, highlighting a similar vulnerability that has been observed in other tools.

Recently, I came across a Pull Request on GitHub for the SSH-MITM tool, which sheds light on a critical aspect of SSH protocol security, specifically regarding RFC 4253 during the KEXINIT process. The Pull Request, available at GitHub https://github.com/ssh-mitm/ssh-mitm/pull/163, describes the necessity of discarding certain packages during the KEXINIT phase to prevent issues with intercepted clients.

Moreover, a look into the GitHub Blame for SSH-MITM reveals that these crucial changes in the KEXINIT step were integrated into SSH-MITM about 1-2 years ago. You can see the specific changes at this link: https://github.com/ssh-mitm/ssh-mitm/blame/4fc3ef418847c35d17d0c427e2701b33a03c323c/sshmitm/workarounds/transport.py#L178-L188

An important note to add is that this information suggests that a similar form of attack, akin to the Terrapin-Attack, could potentially have been exploited for the last two years. This raises significant concerns about the historical vulnerability of systems to such attack techniques and emphasizes the importance of retroactive security analysis in addition to ongoing vigilance.
One-click to generate expert-designed marketing ads, elevating e-commerce CTR
Postfix pays no bounties, our dear ethical hackers could not be arsed.
You somehow managed to write a post where every single sentence is absolutely wrong. FPGAs clearly make sense for prototyping ASICs. That alone makes FPGAs make sense even if it is a tiny niche market. After all, the budget of ASIC companies is big. A few hundred FPGAs for developers are a drop in the bucket compared to the cost of an ASIC.

Too expensive in volume only applies to Xilinx and Altera and with every node shrink, the amount of designs that fit on an FPGA grow while the non recurrent development costs grow for ASICs. Due to this, the maximum volume at which FPGAs remain cost competitive keeps growing with every generation.

Smart NICs make extensive use of reconfiguration because things such as protocols are not set in stone. They can change all the time. It is also possible to build designs that make extensive use of partial reconfiguration.

MPSoCs have been a thing for a long time. If you want to get into those Google Kria 260 and you will be pleasantly surprised.

When I take a look at Effinix FPGAs those are designed specifically for vision applications and massive amounts of I/O. A CPU would struggle with multiple camera streams and consume too much power.

Yeah ok but an 100k LUT FPGA Chip from Effinix costs what? 25€? You're going to need a really high volume to get an overall cost saving. 40000 FPGAs is only a million dollars. The masks of an 22nm ASIC cost 1.5 million dollars without the rest of the development costs.

And finally your last sentence contradicts the first. Next time stick with a story.
> Over time, everyone becomes atheistic.

It isn't universally true. There is no evidence the Haredim are becoming atheistic, nor the Old Order Amish. Yes, there are defectors from both (mostly not to atheism, mostly to more moderate versions of the respective religion), but not enough to counteract the high birth rates.

> Not having children is a function of a society's wealth (which is then correlated to education which is the correlated to non-religiosity), not (necessarily) their religiosity.

The Exclusive Brethren [0] are notoriously well-off, yet they continue to have large families, and there's no evidence of a high defection rate of their children.

> when in reality the entire world's population is dropping, and it's distributed mostly equally, even in areas where there are some of the highest birth rates in the world historically, like India, China, and Nigeria.

According to OECD data, [1] in 2005, Israel's TFR was 2.84. By 2017, it had grown to 3.11. From there, it declined to a low of 2.90 in 2020 (probably in part COVID-related), but by 2021 had rebounded to 3.00, and I expect it will probably be above 3.00 when the 2022 data is released. Israel's TFR in 2017 (3.11) was higher than its TFR in 1981 (3.06). So Israel is at least one counterexample to the narrative of a uniform global population decline.

[0] https://www.smh.com.au/property/news/the-great-brethren-migr...

[1] https://data.oecd.org/pop/fertility-rates.htm
Jeez, Microsoft.

Windows 10 was going to be the last version of Windows.

Windows 11 exists and is full of advertisements.

Windows 11 requires new hardware for an artificial and plainly bullshit reason. It could only be more bullshit if the explanation used the exact words "security experience".

The enshittification of Windows marches on. Even as my distant second OS that I boot only if I have to, it's quite annoying.
My cousins all died from meth and alcohol before any of them reached the age of fifty, but after bleeding my parents of significant sums of money. I hold my friends in much higher regard.
Yes that. Lines up with the meme going around. They call me 007. 0 coding skills. 0 social skills. 7 Udemy certificates.
There are many packages that are web services. What are the install scripts to do?

If you've got a monolithic configuration file you need to parse it and be really sure that you handle all edge cases, including arbitrary manual changes by the admin.

If you split it into small per-site config snippets that don't claim to support every possible Apache configuration setting, you can simply paste them in the right place together.
> Equity: Opportunities are fair and unbiased

No, that's "equality". Quite the difference in what is supposed to be a dummies guide.

https://risetowin.org/what-we-do/educate/resource-module/equ...

*Equality* means that each individual or group of people is given the same resources or opportunities, regardless of their individual circumstances or needs. It's about treating everyone the same way and giving everyone the same things, regardless of their starting point or individual circumstances.

*Equity*, on the other hand, recognizes that each person has different circumstances and allocates the exact resources and opportunities needed to reach an equal outcome. It's about fairness and justice, and it recognizes that not everyone starts from the same place, so adjustments must be made to ensure equal opportunities.
Holiday workers are the true heroes.
Terrapin-Attack Style Vulnerability Likely Exploited for 2 Years!!

I wanted to share some insights into a security concern that echoes the Terrapin-Attack scenario, highlighting a similar vulnerability that has been observed in other tools.

Recently, I came across a Pull Request on GitHub for the SSH-MITM tool, which sheds light on a critical aspect of SSH protocol security, specifically regarding RFC 4253 during the KEXINIT process. The Pull Request, available at GitHub https://github.com/ssh-mitm/ssh-mitm/pull/163, describes the necessity of discarding certain packages during the KEXINIT phase to prevent issues with intercepted clients.

Moreover, a look into the GitHub Blame for SSH-MITM reveals that these crucial changes in the KEXINIT step were integrated into SSH-MITM about 1-2 years ago. You can see the specific changes at this link: https://github.com/ssh-mitm/ssh-mitm/blame/4fc3ef418847c35d1...

An important note to add is that this information suggests that a similar form of attack, akin to the Terrapin-Attack, could potentially have been exploited for the last two years. This raises significant concerns about the historical vulnerability of systems to such attack techniques and emphasizes the importance of retroactive security analysis in addition to ongoing vigilance.
I bet that one has the conspiracy nuts going.
So much marketing speak and AI hype yet not even the slightest hint at how the thing actually works. I presume it's a high-density LCD with some kind of micro-lens array in front of it?
Can't find it any more, but there was lovely response of guy from video to question something like: if they use alien technology. Response was that aliens actually use their technology and without their support their ships would fall down from skies within weeks :-D

Also if nowadays chips are million times denser than these from 90s I'm really stunned that we still don't have desktop chip printers and playing this old fashion components picking PCB design game ;-)
> The 15 hour monthly limit might begin to act as pressure to keep audio books length under 15 hours. Some in sci-fi can exceed that limit now.

When I read this I instantly went to review my collection. To my surprise, approximately half, were under 15 hours. I would have thought for sure none I've listened to were under 15 hours, but like I said, half were.

In my opinion, Spotify audiobooks will fail because of limits like this. When my listening was at its peak, I would crush multiple books a month (at 1x even). If I were a customer, the first time I hit that limit would be the last day I was a customer.
Only likes Python commits
Is that true? I distinctly remember Google Labs being shut down during Larry's Google+ disaster years, and this article seems to bear it out:
https://www.cnet.com/tech/mobile/google-shuts-down-google-la...

(This is also my personal nomination for the oft-asked "when did Google stop being unique and cool?").
A very irresponsible business at that.
BBC BASIC with it's SDL IDE work ok on a mac too!
Running traefik in a less braindead way
Firefox can indeed work with only 1GB, although so little RAM imposes some restrictions on the OS and desktop used. Here are two VM examples: Alpine Linux and DietPi, both using XFCE as desktop manager, with Firefox plus HN front page loaded and one terminal window.

https://ibb.co/4PXrGtF

https://ibb.co/DwcTrQp
How many cycles is the battery good for? Do you want to use up half of them running your house loads to save $2?
You have a veeeery skewed sample population there and probably shouldn’t be drawing too many conclusions from such a small minority.
Can't wait when emu2 incorporates techniques from apple paper https://arxiv.org/pdf/2312.11514.pdf
To display two column layout you need a tall screen, now wide. If you display two column layout on a short wide screen, you have to scroll it up and down in zigzag pattern to read one page.
What you disliked about Logseq? Are you good at self-organizing (were you before)?

While the initial experience is super confusing and I barely knew what that tool is supposed to do, later on it turned out to be the first tool that helped me keep some structure in my notes.

I love note taking but I'm horrible at it, chaotic and inconsistent. Daily notes plus the way logseq easily links articles gave me some decent notes. I even left those to my colleagues when I switched jobs and even plain markdown files were useful for them.
Ask HN: Anything I can do about my missing address on Google Maps?
Nobody can find my house (UK), it is somewhat unusual in that it pre-dates the neighbours and so shares a postcode and road name with the main road not the cul-de-sac it is now situated in. It also has no house number.

Google knows there is a building here (there is a dotted outline on the map) and that it doesn't know the address (if I drop a pin on the building I get a button "Add Address Address may not be up to date")

We've clicked that button a few times over the years and received an email telling us the new address has been submitted for review but that is the end of what we hear from Google.

IIRC Apple maps does return the correct location if you search for our address.

So, this is my bat signal! Is there anything I can do?
I wonder what's going to get happen when they get bored with RCS.
Thanks for bringing this one up. It's almost strange to see a civilized discussion about something that clearly polarizes a lot of people in the thread. Makes me wonder exactly what kind of social dynamic results in a bunch of people actually talking through their differences, instead of the these days usual trench warfare...
This article is not about carbon at all so I'm not sure why you are bringing that up.
https://imazing.com/ can do it, but yes, would be nice if it was built in

photos and videos and notes you can bulk download from https://privacy.apple.com/ - like google takeout, takes several days before they mail you a link to the zip.
too modest for https://lou.wikipedia.org to exist, unfortunately

(compare https://frp.wikipedia.org or https://br.wikipedia.org/ )
Read the article comments for some of the pedantry on why C compiling has be painful forever.

There is no keeping people happy.
Airplanes Fly (1999)
Assuming the post isn't trolling, it's maybe worth mentioning that the GNU project doesn't actually "think everyone should use info pages." The document referenced is the standards for the GNU project. It's hardly "wild" for a project to have a standard and to steer maintainers towards using it.
you both describe valid approaches, similar to a breadth- or depth-first search. one will get into deep waters with "some great big system", regardless of the specifics.
What’s the general solution here? The problem is misalignment of incentives. But paying people more won’t magically fix it. Is it that mgmt needs a lot more technical understanding? This crops up all the time you’d think there’d be a well worn solution.
Long rant about "plastics bad" and then:

> Avoid bringing in all new plastics and single-use plastics into your home and recycle what you have.

He either lives in a buble or didn't do any research.
There is no recycling of plastic. Almost everything is single-use plastic: clothes, bottles, shopping bags. A lot of things are made from plastic which cannot be recycled: TVs, phones, furniture, shoes, clothes, housing insulation, a big part of cars, buses, trains.
As someone who just moved here: this is by far my least favorite part of moving around in the city; and having to dodge bikes on the sidewalks is the worst part of my commute.
George Orwell described that very thing in 1946.

https://www.orwellfoundation.com/the-orwell-foundation/orwel...

> The word Fascism has now no meaning except in so far as it signifies ‘something not desirable’. The words democracy, socialism, freedom, patriotic, realistic, justice, have each of them several different meanings which cannot be reconciled with one another. ... Words of this kind are often used in a consciously dishonest way. That is, the person who uses them has his own private definition, but allows his hearer to think he means something quite different.
I mean, he had a phone too. The firestick is a red herring the BBC are using to sensationalise the situation.
That's more or less what I did with C50. I wrote a simple translator to turn the stack based code into JavaScript expressions, then created a function via new Function. It came out a couple of orders of magnitude faster than the interpreted version.
Silence, Please
I'm not talking this christmas. To GPTs that is.
The entire history is more than I think any sane human is willing to commit to for something as mundane and out-of--my-hands department.

If you are the modern czar of in car entertainment units, perhaps you can enlighten us on how you think this will affect the market.
Unless somethings changed in the very recent term, a few years ago I was still able to find the messages locally in, IIRC, an sqlite DB file (unless I'm thinking of iTunes stuff being in the sqlite db but I definitely also backed up very old stuff, even from the iChat AIM days).
If you are working a lot with those parquet files it might be worth looking at Apache Arrow which is an in-memory/wire format for working with columnar data. It has a lot of good support for parquet from what I gather and is really focused on allowing efficient wrangling of data. Zero-copy and all that.

Note: no affiliation, just in a deep rabbit hole on data
Why would I do that? I use only apps that use text files anyways. I am pretty confident I will be able to open them in 30 years.
No but in full disclosure I have worked with Google before.
Rough.js: Create graphics with a hand-drawn, sketchy, appearance
Maybe lack of imagination?

There are handsomely VC funded successful startups that do exactly this in banking, for example Teller:

https://jobs.lever.co/teller/ebf503af-bb82-49fb-97bd-6d9bcbb...
> 74-82% of US soldiers felt the army should be segregated.

There's a great scene in "A Welcome to Britain" - 1943 film for US soldiers stationed in the UK - that is clearly trying to sell integration to troops:

https://www.youtube.com/watch?v=SyYSBBE1DFw&t=1519s
I did read the article. Unless I missed something, I didn't see anything about why they couldn't add some mechanism to bypass these warnings for old files.
This type of project is protected from CFAA by Van Buren. AFAIK the only untested precedent is ToS violation.
I think HJKL is fine because I primarily move my cursor down and I primarily use my index finger for things as opposed to the other three (non-thumbs).

On the other hand (no pun intended), I have countless hours invested into WASD since the Quake days[1] in the 90s. There I press W most often and most definitely with my middle finger. So the middle finger can definitely be trained to a very high level!

[1]: I started my shooter "career" with Wolfenstein 3D but since there was no mouse involved, I was using the arrow keys. On the IBM layout one would press up and down with the middle finger (which I suppose is sort of your point).
That strategy seems to be useful only for flights in the afternoon/evening (depending on how long the contrails persist) and night to avoid trapping radiation back to space. But during the day contrails should reflect back to the sun. Optimize routing to create them (only early during the day, so they disappear before it gets dark).
Of course! I'm not saying it should be done, it absolutely should. There's no place for profiteering from people's health like that in a civilized society. Just that making it public is not the end of the story either.
"An LLC is a pass-through company, so if the company is registered with you, you will be taxed on everything you have in the LLC."

Correct by default.

You can elect for the LLC to be taxed as a C Corp (form 8832), and this way the LLC will not be a pass-through entity.
Scientists Explain Why 'Doing Your Own Research' Leads to Believing Conspiracies
Exactly that. "Build it and they will come" is one of those stories only the victors tell. My own approach was to tell everyone to go away who was asking stuff and finally give in to the most persistent person, then reluctantly build something and sell it to them because I couldn't be bothered to deal with it. This gets you a comfortable life but not rolling in cash and you get to retain your sanity, your dignity and your ethics.
A selfhostable blogging platform!
I don’t know if there are any minis up on the site, but Apple has a refurb store that is usually pretty solid on price (or was last time I looked). Pawn shops aren’t a bad idea either - typically heavily marked down electronics, and if you find little ones tucked in next to bodegas you can find some unexpectedly good electronics.
I remember the time, quite a long ago, when I have visited Leonard Da Vinci's house (museum today), where many of his original drawings and modern replicas where exhibited, and I have discovered many more apparatus than I knew he imagined.

I was very much inspired by human capacity to imagine the things that don't exist, and often couldn't even be created by the time they are imagined. Da Vinci's machines, first computers (Babbage's "analytical engine"), modern works like fusion power or quantum computers for example. And as new technology is invented and new discoveries are made we continue challenging ourselves.

Having said that I am certain humans are not the only ones able to do so. So I will live this open-ended like this, just a tribute to the marvelous complexity of the intelligent life on Earth.
What do you find easier to work with compared to minikube?
As for the easiness to spinup, minikube also introduced a way to spinup a cluster in a container - so it's as smooth and simple than Kind.
https://minikube.sigs.k8s.io/docs/drivers/podman/ and https://minikube.sigs.k8s.io/docs/drivers/docker/
>incredibly polite disagreement

Not sure I agree. Here's one comment by the developer (laurent):

"Ok, there's so much wrong in what you write about that it's hard to know where to start. I guess it would help if you had a clue about what you're talking about."

https://discourse.joplinapp.org/t/why-im-leaving-joplin-for-...
They specify what version of texlive they use. This is significantly better than what publishers offer (usually a really old latex version, not even pdflatex).
I agree with everyone here: it’s named correctly, but other languages did it… differently. (Stopping short of “better”, but only just.)
> they just want a product that works well

It doesn't if it can't reliably do basic things like sending e2ee messages to people using smartphones from other brands with its default messaging app.
I know this is a tangent, but if anything, western culture is better about this. We're not an "honor" culture, and we don't warp family relationships to "save face". People are not even allowed to apologize in some other cultures because it brings shame on their family/group.

To give a really grotesque example, there is an country run by autocrats that carelessly unleashed a plague on the world because they prioritized their self image over taking descisive action to prevent an epidemic.
> Windows 10 ... an environmental disaster ...

Why do people need to repeat themselves ? /s
That is so true. The best supported Linux laptop nowadays is the Win11 laptop of your choice with WSL.
These look like weekend OpenAI wrapper projects.
>> actually listening to developers and looking at how the space develops instead of chasing own vanity projects.

This is what WHATWG is. It is also why everything is "worse" and "better" than when it was just the w3c. I don't think we have had clear, cohesive, design intent for the front end/browser in more than a decade, and it isn't getting better.

I spent years working in PHP, and my life is better in Go and C... I would rather work in circa 2004 PHP code than what modern JS looks like. The whole stack of framework, tooling, linting/ts, node/bun, build/transpile... SO. Many. Dependencys... I had a 10 minute conversation on what the fuck a "thunk" is and why I would want to use it yesterday, this is the front end of 2023/4

And I give credit to front end engineers for keeping it all going, frankly there isn't enough cocaine in Columbia to get me to do it. But I'm not sure any of the people who think that this is OK or its how to build a web page are the ones we should be letting ADD features to a stack we want to be backwards compatible. Its how we end up with stray stuff like web components and shadow dom that never live up to the promise and then we drag them around for the rest of time cause space jam and what ever comes after still needs to render.

I'm gonna go back to the back end, I would rather face down the expensive foot gun of autoscaling than risk my sanity working in the front end.
> Instead, Burkey’s model uses a bomb tunes to produce a crazy amount of x-ray radiation which heats up one side of the asteroid. You heat it up so much that the rock liquifies, then bubbles, and outgasses - and forms a propulsive engine, right on the surface, shooting out gaseous ultra-hot rock.

Sounds similar to the ablation ("outwards firing rocket engine") theory for how the secondary gets compressed in a thermonuclear bomb. Pretty cool.