skysight-inc/HackerNews huggingface dataset:
Even thats weird how they refer to “employees” like its hourly folks doing all the theft and not scams at a higher level
Miami University comes to mind
I work for an employer subject to ITAR and have never heard of this requirement.
Google, where shutdown dates get their own shutdown dates because they just love shutting things down. Meanwhile 37signals (creators of bandcamp, hey.com) is still maintaining 6 (maybe more) "dead" services for paying customers. How long will they do it? Who knows but the support is there and has been for a while. I know it's note exactly a novel idea but at this rate I'm reminded almost monthly why Google deserves zero trust for long-term solutions business (or personal) solutions.
I agree that we should all avoid HP. Just the worst.

But the Brotherly love might also seem misplaced, at least according to one HN thread from last year:

https://news.ycombinator.com/item?id=31860131

That said, I have a Brother laser printer + fancy scanner that can upload direct to Google Drive and I’m very happy with it. And from my research other brand toner seems to be allowed on mine (L8895CDW).

So… shrug?
I don't mean to be snippy, but this is kinda what the whole Cold War was about. There were constant consequences for the spying. For domestic I think we can point to Watergate, Contra Affair, Snowden Leaks. I have some more recent examples but I think mentioning them will result in arguing and move from the topic at hand. You may not agree that the consequences were severe enough, but there were consequences. I think there's also a strong bias in that consequences take place after (often months or years) and there's less attention given to them so we often aren't even aware. But if consequences do happen, it does mean the rage machine was effective even if far from optimal. Worth noting that there is a danger in lack of attention to consequences, since it can lead to apathy and thus actually enable consequent-less actions in a self-fulfilling prophecy.
Yeah this is what I love about KDE. User choice is a design ideal to it's developers rather than a dirty smell like it is to Gnome devs.
>Not even close. The vast majority of journalists, lawyers, activists, even public figures, don't have the knowledge to secure their digital lives, don't have access to an expert to do it for them, and in many cases aren't even fully aware of the nature of the threat (beyond some vague idea along the lines of "I'm probably being monitored").

Citation needed. Because everything I have ever seen is that iOS users almost all leave on autoupdate and the move to the latest version is the overwhelming majority, very rapidly. Seriously, look at adoption each time over the last 5 years on a site like statista [0] or wherever, or various ones aimed at developers. If you want to claim that people at higher risk aren't part of the 60-85% I'd honestly be curious to see your numbers. Note I said "decent" not "best" practices. Whatever its flaws, mixed incentives, and issues (which are real), Apple has expended significant effort in making the normal default paths provide an ok baseline security for regular people and discouraging leaving them. Which isn't even something a lot of HNers like! If anything, I'd be unsurprised if HN types to lag in some respects because we want more control and to do things outside the well trod path. I've jailbroken a lot, is that something most people do? No.

In this specific case, the minimum needed to avoid a zero-day exploit is (by definition) merely to always have the OS updated and all security patches applied while staying firmly within the walled garden. Which it's objectively clear the super majority of regular people do. If you just go with the default and let Apple update your device whenever Apple wants, then it's a truism that anything you get hit by is something Apple hasn't yet patched. And in turn anything that raises the population probability that the 0-day actually gets noticed and potentially reported raises the risk of using the 0-day. The whole point of this feature is that it'd let a normal person who doesn't necessarily understand threat mechanics go "huh, that's funny" and then maybe say so on their social media/blog/wherever, at which point if even one person who follows them (and we're talking journalists or other types with enough influence to get targeted by major threat actors right?) recognizes what's going on and says "quick call Apple/security researcher/tell HN" now it's out there.

>because those practices have no observable effect to them

Literally the entire point of this new feature is to create an observable effect of tampering. Kind of a weird statement in context.

----

0: https://www.statista.com/statistics/565270/apple-devices-ios...
Kia's scheme to deliberately withhold deliveries
Lead is hazardous which is something the marketing material explicitly avoids.
> New Brother printers are encraptified now too.

No, new Brothers are fine. A while back where were a very few models that got a questionable firmware release. As I recall, they weren't common retail models. The firmware might have been a beta.

Brother got some crap for it, people circulated the IPs of their update servers (for blocking) and that was the end of it.

I regularly buy new Brothers for customers. They're fully fine.
...then you write a bunch of abstract hammer factory interfaces and make someone else do the real work.
Changes to the platform or dependencies break working code. This is increasingly hard to ignore when app stores stop vending your product to older versions of a platform, even if it's working fine.

And working code, no matter how well it works, imposes a cost to implementing new features. A new feature might be a cinch to implement in a new app. But it can easily take much longer to implement the same feature in an existing app.
> arguably the weirdest mitigation strategy that I've ever seen for a problem like this -- to literally send the URL into another opaque system that just spits out "safe" or "dangerous" with no indication to the user why that is.

I can imagine the AI thinking that the top left most bit of `d` is sharp and pointy and therefore not safe, but `a` has no significant protrusion and therefore is safe.
https://ghostarchive.org/archive/RcYtd
The controller was frustrated? I didn't detect that at all. I only detected frustration by the pilot when he started swearing and making threats.
Not only did they concoct such a scheme...

Not only did somebody review and approve it...

But they broadcast the details of it to hundreds of employees and dealers via online meeting.

I couldn't believe it but cbc actually saw the video and you can catch a glimpse of it [1].

Thays just... Brazen? Insidious? Evil? Stupid? All of the above?

1: https://www.cbc.ca/player/play/2293332035648
csid.com redirects to Experian to make it look more legitimate but... what's that go to do with okta? Seems to be a scam.
Most dont even have a PC that they assemble themselves. They have very little idea of the internals. Nor do they follow and read enough about hardware news and articles. These PC could be used as Server. While not professional rack based ones, but you will still need config them.

A lot of these basic understanding and fundamental learning experience is gone. We are not far from Front End developers that dont understanding anything about HTML and CSS but only React.
I'm surprised they didn't go with the most obviously correct solution: don't allow markdown images that reference other domains. That's what Google Bard does.

What's the argument FOR rendering images hosted outside of ChatGPT?
In my area, a condo complex of 93 units was purchased by 16 individuals (or companies). All of the things you mentioned are definitely a part of the problem.
> Just to be clear, I'm not a Bezos fan, and I think anyone who is fine with having accumulated that much wealth, should perhaps think a bit harder about, things, to say the least.

I think it's always useful to treat a person's general intelligence, skill in a particular field, and personal ethics as orthogonal properties.
No, I meant that part to be a little mean, and I wouldn't be upset if the other poster had taken offense at that; it's a tradeoff.

I'm offended that they emitted actual word salad at me followed by a random (and actually wildly offensive! or it would be if it made any sense) accusation that was unrelated to anything even close to anything I said.

That's what I mean by "bad faith".
Probably because there’s no dedicated front desk and any random person could be the host is my guess?

I don’t know. I prefer my accommodations with a front desk, if only because I tend to check in at odd hours and it’s nice having a human available to help if there are issues.

By comparison AirBnB seems like those annoying customer service “AIs” who are always eager to let you know how much you can get accomplished on the company’s website.
Still not an argument for ever using them as reliable evidence. You have to trust whoever made the original hash to not have generated it with a duplicate, innocuous image providing a collision. These hashes are not verifiable as they appear to be parts of secret databases, so you are trusting the authority of that database not to do something like make innocuous colliding images for the sake of violating your personal freedoms.
It feels like there must be an almost unlimited array of clever ways you could exfiltration data using multiple calls to multiple carefully generated file names and subdomains that are designed not to trigger the new filter.
Co-Scientist AI – Autonomous chemical research with large language models
I don't understand why what seems like such obvious common-sense about this flight is so controversial. Is it the lack of deference ATC gave the pilots, treating them like equals instead of superiors?
I've been running my super cheap Brother HL-1210W since probably 2015 with the cheapest toner I can find, and it still goes amazingly well.
And that’s not what I’m referring to by their shenanigans.

Specifically I’m talking about their beeper mini spoofing of Apple devices, not the other beeper setup that forwarded content to/from an actual Mac.
There's more to it than just third party GPTs.

ChatGPT can read URLs. If you paste in the URL to a web page you want to summarize, that web page might include a prompt injection attack as hidden text on the page.

That attack could then attempt to exfiltrate private data from your previous ChatGPT conversation history, or from files you have uploaded to analyze using Code Interpreter mode.
It doesn't seem particularly evil. Is there a better word for "Dilbert-esque but on a massive scale"?

I think the funniest part is that they were completely transparent about why they were doing it. Good for them, honestly! But I can't imagine Kia HQ will be pleased to know why. Maybe they wanted HQ to know, as a desperate measure of protest against bad budgeting policy...
I too enjoy video games but I also think they are a massive waste of time. If I could rewire my brain to have the endurance required to constantly try to learn new things, that would be my preferred mode of existence. Unfortunately, I often seem to need to "turn off" at the end of the day, watching something lame on netflix, switching on a game, reading a forgettable piece of fiction. It is actually pretty frustrating but I have done it my entire life so I don't see this ever changing.

"Fun". Well if you have a family you need to support, I think it becomes a lot more obvious why "fun" is something that should often be dropped. There are other things that need to be done and they are definitely not "fun". You will, however, be rewarded in other ways that entertainment simply cannot.
Comcast Leaks Customer Info
This is Comcast's publication on the October 2023 leak of customer information. The most relevant section is copy/pasted below:

> What Information Was Involved? On December 6, 2023, we concluded that the information included
usernames and hashed passwords. For some customers, other information was also included, such as
names, contact information, last four digits of social security numbers, dates of birth and/or secret
questions and answers. However, our data analysis is continuing, and we will provide additional notices
as appropriate.
This is about closing down a data exfiltration vector, which a successful prompt injection attack might use to exfiltrate private data from your chat history or files you've uploaded to Code Interpreter.
Sorry, I should have mentioned that my dad got his start in nuclear at a reactor at Hanford. For some reason, he was included in on the settlement due to improper storage of waste, which is why the settlement was from the DOE and not Westinghouse (the company he was actually contracting for). I wouldn’t blame the reactor for the cancer, I’m not even sure it was the waste’s fault, but the cancer was rare enough to qualify.

If we bought plans for the French, I’m sure we could merge in American culture quickly. We won’t find any pure nuclear engineers being trained up in the USA anyways outside of the navy, there are only a few programs left.
>Facts can be seen as important without implying any specific interpretation of them.

This isn't even true. In the example you gave, you clearly remember the speed of light because you think it may be useful someday.

When someone believes a fact is important or "worth noting", they used some reasoning to arrive at that conclusion. Whether or not that reasoning is flimsy is another matter.
As a long time backend developer and new front end developer, I gotta say I find JSX to be downright wonderful.

There are some oddities with react but wow jsx makes my code clean and easy
Scale-free network topology enables a crude but effective split of neurons into hot and cold classes—hot neurons at home on the GPU and larger numbers of cold neurons that benefit from more memory on the CPU. Clever!
You can trim down those notes a lot, like instead of `npm install`, I write a shell script called `script/prepare-env`, instead of various scripts written in a package.json file, I've standardized on `script/start`, `script/build`, and `script/deploy`. Now, no matter the language or package manager used, my workflow is the same.

And you could clean up the GitHub Actions file by just passing the base url to your build script, IE `BASE_URL="/${{ github.event.repository.name }}/" script/build`.

I mean no offense, these notes aren't that extensive, and most of the content is for setting up GitHub Actions / GitHub Pages. npm install / npm run dev / npm run build aren't very esoteric, and can all be documented inside the repo.

I'm actually a little shocked to find out you're a co-creator of Django.
Oh wow, so CSIdentity Corporation was combined with Experian in 2016: https://www.experian.com/blogs/news/2016/04/18/csid/ so this email appears to be legitimate:

Original Message
Message ID <1531460072.29729015.1703124342154@marketing.csid.com>
Created at: Wed, Dec 20, 2023 at 7:05 PM (Delivered after 0 seconds)
From: Okta <okta@mail.csid.com>
To: "kseifried@cloudsecurityalliance.org" <kseifried@cloudsecurityalliance.org>
Subject: Okta October Security Incident – Contact Information Exposure
SPF: PASS with IP 96.46.132.207 Learn more
DKIM: 'PASS' with domain mail.csid.com Learn more
DMARC: 'PASS' Learn more

Which means the text of the email:

"As a security best practice, Okta strongly recommends that you enable multi-factor authentication (MFA) across all your online accounts as a key protection against these types of attacks."

Is especially ironic considering how Okta got popped.
One would hope that in vitro studies with human cell lines would identify those possibilities.
IIRC they recruited and actually signed a kid (Football maybe?) who later decommitted once he realized it wasn't in Florida. I'm not sure that's entirely accurate because I don't think you get to signing without an on-campus visit but maybe that isn't always true.
Bird the company has/had lots of problems, but I'm sad to see them hit bankruptcy for what it signals about micromobility as a whole.

I've long been frustrated that micromobility is held to a standard no other transportation mode is expected to meet, at least in the US. E.g.

- "Micromobility doesn't make any sense, you can tell because all the companies lose money." But every other form of transportation is deeply subsidized! In the US we spend hundreds of billions of dollars per year on roads, trains get federal infrastructure money, public transit [where it exists] isn't close to fully paid for by fare revenue, airlines get bailed out in recessions, all carbon-burning transport has an unpriced carbon externality, etc.

- "I hate the scooters, they clutter sidewalks." Often the clutter is real and a problem and I wish people behaved better. Among the people who I wish behaved better, I'd include car drivers who park in bike lanes or on sidewalks, yet the prevalence of such behavior doesn't create widespread calls to ban all cars. (Well, in some corners of the internet...)

More generally, it's weird that scooter companies are liable - legally or de facto - for such behavior at all. If I get a rental car from Hertz or similar and then park illegally, nobody claims this means Hertz should get a ticket or be shut down. Why are scooters different?

At the end of the day, in the US we've built our legal regime and land use patterns around the assumption that most travel should be by car and this travel should be subsidized. The fact that scooters create some frictions by taking up some of the space left over by cars is more an indictment of the system than of scooters.
They both suck, TOFU is bad. Apple should apply their central pki to certify that contact with their icloud id.

TOFU is a good idea when you don't want a central party arbitraring identities like with federated matrix. Makes little sense with apple.
Missing: in polyphonic instruments, notes affect other notes. For instance, on a piano, a staccato C2 by itself is a totally different beast from a staccato C2 played while the dampers are off other keys, from a haunting reverb from notes in a higher register to deep overtones from notes in a lower register.

Most simulated pianos these days add the extra harmonics when the sustain pedal is pressed, but very few seem to get the harmonics from the dampers being lifted per-key; PianoTeq gets this right.
It’s strange to know some people think that way, but I’ve never experienced a community where someone would get more respect for having a Rolex. It’s such a bizarre idea - who cares
I mean... you can't just fill up. You have to scan a card, wait 5 seconds, enter your zip code, select the button for "grade". Credit card skimmers at gas stations are a big problem too.

You may have been used to that process so it seems more fluid, but Tesla charging is truly "plug and charge" at superchargers
thats the only correct eay of dealing with the issue. If you can't maintain infrastructure you failed at your job, why should someone be stranded or freeze to death because of your incompetence
I’d like to see that “how Wayland ended up worse than X11” post, but I’m afraid I wouldn’t understand it any more than the other Arcan writings.
Ah that makes more sense! Thank you for clarifying.

For me, In the past ChatGPT has refused to access URLs directly, but it's willing to search them on Bing and then access them indirectly
That sounds like a surefire way to ensure you'll be a cog for your entire career. Focus on delivering results.
No shit, because those cars are in spaces designed for them not strewn all over the place.
We had Bird electric bikes in our town. They were too expensive to use, though some people did. Mostly college kids from what I could tell. Still, I used one once and it cost me $10 to get just a couple miles. Not worth it.
Or maybe put "Paraquat" in the title instead of talking circles around it.
The fare isn’t calculated on the spot though, a base amount is authorized and then only charged later.
Not that the plug needs to figure that out immediately but it’s worth noting.
Yeah the link posted here as if it’s the home page might be confusing people: this is one of many templates, which happens to be for people looking to publish their web application, as opposed to their other templates like blogs, marketing pages, SaaS pages, etc

If you click around the site, you can see that “components” are separate from (and comprise) the templates
Make Your Christmas Tree Dance to the Beat
I feel like the brother info is outdated. New brother lasers printers check tonner drm and have a tendency to get it wrong even with original toner.
If Walgreens decides the burden of theft is simply too much to bear, they can always close up shop. Entirely or by location.

A worker often does not have that flexibility. They have to take whatever they can get, often very much including wage theft.

In times of such ludicrous inequality I simply have zero empathy for the wealthy. They have pillaged our entire society with fantasies of infinite growth for decades and the poison fruit of that process permeates every space in our society. If they want empathy and community, they're more than welcome to give away all their money and join the rest of us poors in the shitheap world they have built. Till then, fuck em.
I came here ready to fetch my pitchfork, toss the HP in my home office, and buy a Brother.

But looks like the price is going up between 0.5 EUR (for the 10 page plan), 3 EUR for the 700 page plan, and 5 EUR for the 1500 page plan.

I looked at Brother printers just now - looks like CAD 500-1000 for a good one, with dubious AirPrint support.

Instant ink is still well worth it for people like me who print < 1000 pages per year, sometimes from my phone.
The people that throw them in the river are not the environmentalist kind but pretty trashy themselves. The kind that hang around street corners in groups making you feel unsafe. We call them 'hangjongeren' in Dutch (meaning youths hanging around).

Ps I hate these scooter companies but throwing them in the rivers is terrible for the environment.
https://flowbite.com/ is free and supports Vue too :)
They will still stay around for a while.

There's also Renesas Rx, an ISA heavily inspired by m68k.

But even Renesas is shifting to RISC-V, sensibly so.
The Cardano Foundation has partnered with Petrobras, the state-owned oil giant of Brazil.
Those who successfully complete the blockchain course will be awarded a certificate.
In an effort to educate the public about blockchain technology and explore its potential applications in the energy industry, the Cardano Foundation has partnered with Petrobras, the state-owned oil giant of Brazil.

In a statement made on December 20th, the foundation announced that they will be hosting blockchain education seminars for Petrobras’ 45,000 workers. Also, the information from Cardano Academy would be made accessible via Petrobras University. Petrobras, the biggest Brazilian and South American enterprise, was founded in 1953 and had $124.7 billion in sales in 2022.
VMs don’t share the kernel with the host. Any host escape would need to happen through a device driver exposed to the guest (virtio, etc.) Containers use the same kernel, obviously a much larger set of code. More code means a greater chance of vulnerabilities.
How do you mean? As in Apple is requested to share info, & when they do so they modify data that would cause the key verification to fail, notifying any contacts of the suspected user via notification?
That seems like a heavy lift for a watch unless we’re deciding that the watch brand and model is a shibboleth for other social groupings.
how does that work if you wont be hired without prior experience in a particular stack to begin with

for current employment I’ve only ever seen teams push for using the next shiny thing solely to get that experience and professional validation in the current role, to be competitive for consideration in the next roles
Cars aren't littered randomly on every sidewalk. If they were, everyone would be up in arms about it. Converting existing parking spaces into dedicated bike/scooter parking seems like the better option if you want more scooters and less cars.