skysight-inc/HackerNews huggingface dataset:
> It is basically impossible to know what a system is without accessing it and looking around.

What reason do you have to needing to know what a system is? Just because you think you have a password for it?

> If security finds you in a room you aren't supposed to be in, is that your fault?

It depends. Do you know you're not supposed to be in that room?

> Should you be punished?

I've run into this exact same situation three times. One was a hard coded SSH key to a root account, two were hard coded passwords.

In all three cases, I simply contacted the vendor, let them know I had this key, coordinated disclosure with them, and then told them what the password was and where I found it.

In all three cases, the disclosure was enough for them to go wide eyed, immediately understand which systems were impacted, and then quickly leave the call to go fix the problem.

There is _zero_ reason for you to _use_ exposed credentials if you find them. It adds nothing to the "security research" you may be doing.
I should have said "clean energy", you are obviously right about nuclear power.
Yeah, this is exactly the case that the headline reminded me of (I got instantly downvoted for commenting about this for some reason). If they had actually encrypted the data it would have been fine, but BASE64 encoding is not encryption. It's trivially easy to decode base64: https://developer.mozilla.org/en-US/docs/Glossary/Base64#the...
They pay well and promote quickly
That's called gatekeeping. Wonderful opinions can come for anyone.

A scientist is someone who found someone to pay them. Nothing more, nothing less.

Ignoring ideas unless they came from a brand is the opposite of science. Then you drop your brand (physicist) and expect others to judge your opinion as more important. It didn't work. As a senior physicist in quantum sensing I'm invalidating your brand.
SciHub provides an index of their DOIs [1] as well as torrents for the actual content. I presume one could cross reference citation counts and pull the top few hundred papers in different fields to get a pretty good sample over time and research fields.

[1] https://sci-hub.se/database#download
To be clear, are you saying you don't think any of these companies paid directly or indirectly (a PR firm) for this article?

Linking to relevant websites is a common practice in digital journalism.

First, there is just journalism. Second, there is a big difference between an article about products and an article about news.
Okay then. Then that’s what their next plan of action is. I thought you were going for some kind of burn.
But that only spans 3 weeks. Going by layoffs.fyi, there were ~262.5k layoffs in 2023. That's more like 15% of devs laid off in the past year?
> How about this, why don't SK, UK, French and US regulators get together and agree on a common set of regulations for reactor design. Then they can focus on the site specific regulations unique to each installation.

How does that benefit the groups funding major candidates in the US? I don't know about the other countries but you can be confident that the amount of red tape involved in reactor construction in the US is not a bug but a feature to many of those responsible for it.

Nuclear power is generally stable and predictable which reduces potential peak prices, but it doesn't scale down well so having a lot of it during times of low load means off peak prices will fall. Expansion of nuclear power thus threatens the profit margins of a lot of powerful organizations.

---

See also: Cars. It is not technically possible to produce a single light passenger vehicle that can be legally registered without modification anywhere in the world.

The US's Federal Motor Vehicle Safety Standards and the UNECE Global Technical Regulations that apply in much of the rest of the world are incompatible in a few ways that mostly relate to lighting/reflectors and crash structures. As a result, every "world car" offered in all major markets in fact has at least two and usually three variants, typically UNECE LHD, UNECE RHD, and FMVSS LHD.

This wouldn't be particularly hard to solve by either updating one or the other to be compatible or by the US accepting UNECE LHD vehicles, but the existing automakers that sell around the world have no interest in making it easier for others to compete.
Had a food startup in the Netherlands.

Worked with PostNL, the main and previous governmental organisation for sending mail.

Weekly we would upload our orders in their system; and could see our history.

Then one day we could suddenly access all other clients history and export their users data. Many of them direct competitors, and their mailing lists would have been quite valuable to us.

My partner exported all Marley Spoon's (a bigger funded competitor) data in excel and a few others. When he told me I told him to delete it ASAP, even though it's fun you don't create a liability. But we could have used it to grow 10-30% in a few weeks.

They never reported it, which they were legally obliged to do under EU law.

All to say, if you get the keys to the castle, maybe don't use them. Or maybe you do.

We should, and could have used it, in price negotiations since they almost doubled the prices to us for the next few months and didn't have any mercy. Let alone misplacing 3-8% of our orders and not refunding.

But instead we moved to few other delivery services (with all their own flaws)
I have a simple workflow I use for ENV vars. Another comment noted a script written which likely does more but I haven’t fully read the code. Here’s my simple workflow in case someone is interested.

Create a DB in MacOS keychain called envs:

security create-keychain -P envs

Then use these shell functions:

which get-env
get-env () {
security find-generic-password -s "$1" -w envs
}

which add-env
add-env () {
security add-generic-password -a "$USER" -s "$1" -w "$2" envs
}

Then add one via:

add-env ENVNAME SECRET

Example using it:

ENVVAR=“$(get-env ENVNAME)” ./script.sh
I said it thousand times in different but related at root topics, quality and reliability are possible but why would somebody build something that would last forever? It’s more profitable to churn cheap garbage over and over specially when customers wouldn’t pay for quality products or when a new, more flashy and feature-rich one is launched everyday. It’s the same for electronics, fashion, cars, machines and anything. Manufacturers just push consumers to “desire” the brand new product but the grinder is spinning faster and faster and the landfills getting higher and higher.
Probably partially to reduce momentum in profit extraction from competitors
Happy to chat if ya like! Email in profile
Keeping in mind what a browser could have been in 2024 if Apple hadn't disallowed/slowed innovation, it's fair to say browsers aren't allowed on the App Store.
Add VPN to that list. It used to be a monumental pain to set up a home network, but now with something like Wireguard/Tailscale/ZeroTier/Nebula you can do it in a few clicks.
One aspect of RSA that may help it become relevant again is that the key size can be arbitrary by utilizing multiple primes (RSA-MP[1]) and therefore increase the qubit requirement for a successful quantum attack. This could lead to a situation where large RSA keys would remain secure for decades longer than ECC keys, and if quantum computers hit a growth wall then those RSA keys could remain secure forever.

RSA-MP would then serve as a hedge (by either ending up completely secure, or buying time) against novel* PQC algorithms being broken. The cost being large public keys, large ciphertexts, slow decryption and very slow keygen.

Another option is to come up with enormous safe primes for good old DH. This would result is very fast keygen, and decryption performance will equal encryption - but will probably be worse than RSA anyway. The biggest public DH safe prime I'm aware of is 16384 bits (unofficially released by someone who worked on some DH standard which ended on 8192 bits).

* McEliece is not novel but did not see as much scrutiny as RSA. And has huge public keys - so might as well be paired with RSA?

[1] <https://www.degruyter.com/document/doi/10.1515/JMC.2008.006/...>
so far hees made nothing but viral spyware but its all about to change!
I was doing something similar for a particular work function where I had to log things constantly throughout the day. However, since Obsidian simply uses text files, I used a keyboard shortcut to bring up a text prompt, which then appended the text to the correct file (which was based on the current date. This way it didn't matter if Obsidian was open or not, it would all get logged. In theory, I could have switched to a different text editor to manage the notes and kept by automation in place, I like that flexibility.

On the Mac I was using Hammerspoon for this. On Windows it would have been something like AutoHotKey.
You're not really given it though. You found it and even though nobody ever asked you to use the key card you used it on the floor that nobody ever asked you to go to.
Oh wow, I'd totally forgotten about Ello. They were never going mainstream with that yuppie aesthetic
I’m convinced it’s not done in many areas of science. I have seen it done extensively in others.

The point is: I’m not sure doing it should be qualified as plagiarism.
Yep, what the guy did here seems at worst a misdemeanor, and only because a company's feelings were hurt. The vendor brought charges against an employee of their customer, someone who was paying to use their product.
Don’t let the facts get in the way of a good story.

These e-mails are all templated waffle, crafted to avoid legal liability. Don’t ever take it personally.

I find it very entertaining to read the real and the fake ones.
It is always so tragic to me that, for over a decade, I would have paid for Twitter. But by the time they rolled that out, enough had changed that there's no way I was going to pay for Twitter.

Market timing is hard.
If there is a discount, it will be tiny:

> “We’re so short on GPUs the less people use our products the better… We’d love it if they use it less because we don’t have enough GPUs” — Sam Altman

> Meta who has the 2nd most H100 GPUs in the world is increasingly leveraging GPU supply as a recruiting strategy.

https://www.datagravity.dev/p/2023-year-in-review-the-great-...
And we help them out for their own sake, so that they can live a life of their own eventually.
https://en.wikipedia.org/wiki/List_of_countries_by_GDP_(nomi...

lol, that's an investment!
My final question after 3-month panel interviews:

"How do you do a global replace in vi?"

--

I blanked and said "I'd google it"

They said "thats the best answer"

(they also asked me what a type of comapny Google was... I said "Most think youre a search company, but really, you're an advertising company" 2008.

When I interviewed at Twitter in 2009-ish, they asked what type of company I thought Twitter was; "You're a global sentiment engine"

--

Go ghosted by both after saying I ranked super high on their metrics... (goog actually stated they were going to give me an offer, then called the next morning telling me they were rescinding offer)
It's not similar at all.

The key (connection string) was already given to him via the app and he was entering the house (database) on a regular basis.

This would be like mistaking a door for the bathroom but find a closet full of gold instead.
EXACTLY! what I was assuming.
There are nuclear plants that have been decommissioned and have not exploded. So using just this data, there is a probability that a given nuclear plant will melt down in its lifecycle. And that probability is greater than 0, but far less than 1.
I can emphasize and relate. Unfortunately.

My wife of 10 years died of something called ADEM. "Acute disseminated encephalomyelitis". I'll save you the search, it means something (often immune system) strips the Myelin off the nerves in the brain. No Myelin, no proper electrical conduction. In my wife's case it was described as "fulminant", which means "severe and sudden onset". No kidding. She went from standing and talking to bed-ridden and not knowing who I am in 4 days. 3 days after she was "solement", meaning she wouldn't wake up fully. This is commonly described as "being in a coma". About a month and a half later I stopped supporting treatment, just like you did. I, she, were "lucky" (heh) that she didn't survive much longer and died just 3 days after.

I remember the doctors explaining the MRI (took a long while to get a sympathetic neurologist that actually sat and explained to me what's going on), the hopelessness, the decision to pull support and accept whatever happens next. I remember telling the hospital staff "just make her comfortable", though I didn't believe she was still there. Her brain was too far gone.

That decision was the hardest I had to make in my life. "yeah yeah" people might say (not you though, Lars, you know). But no. It was the hardest. To give up on the person that made your life whole. To know there will never be a replacement. Hoping (sorry, not a religious person, I don't really pray. I did try to make lots of deals with god during that time though) that things will get better, then just easier, then finally just end quickly.

Brain diseases are horrible. They frighten me beyond anything else in the world. You see your person change, disappear. That made me not believe in after life, souls, etc. What existence can there be after if you see memories disappear all at once, basic abilities like talking, moving, eating. Maybe there is something, but it's not the person anymore. That was the brain, the memories, the learned behavior and experiences they had in their lives. And when it's gone, it's gone.

I know what descending to that dark valley is like. What walking through it is like. I hope you can come back up towards the light. Eventually. Maybe.

One bit of practical advice: Reach out to psychologists (talk therapy) and to psychotherapists (psychoactive medicine). It's not a shame, it's a strength. Your brain undergoes significant changes and things get out of balance. Talking, pills - they both help. Today's psychiatric medicines are much more advanced and targeted than even 10 years ago, not to mention Hollywood's depictions. "But I'm afraid it'll change me, it won't be me anymore!" - sure, but is being you that great? You can comment here and I can share my own prescribed cocktail to your blog email.

Be strong. The sun will come back up. It won't be as bright or as warm, but it won't be dark forever.
The article points out that Oxman's definition of Euclidean distance is jumbled nonsense. I took a quick look at a related Oxman paper [1] and it is a mess. I found a different and even more jumbled definition of distance:

"Euclidean distance √ (d = x2 + y2, also called the L2-norm)"

I don't know how you'd get something this messed up if you understood it at all. The non-superscript 2 is an understandable typo, but the square root is in completely the wrong place. And is it supposed to be applied to all the text in parentheses?

I also note that the definition of tesselation is also completely confused:

"The breaking up of self-intersecting polygons into simple polygons is called tessellation, or more properly, polygon tessellation."

This definition (most of the paragraph is cut-and-paste from Wolfram MathWorld [2]) is a very special case of tesselation since normally you're not dealing with self-intersecting polygons.

(For completeness, I'll mention that the paper uses "ray" when it should use "line segment" but that is kind of quibbling.)

[1] https://papers.cumincad.org/data/works/att/acadia09_122.cont...

[2] https://mathworld.wolfram.com/Tessellation.html
> I will always remember the Slashdot comment that said that removing the passenger seat of your car so you could sleep in your car was a reasonable thing to do, and everyone saying it was suspicious was a hater. (Bro. A car floor isn’t even flat.)

> (Bro. A car floor isn’t even flat.)

> (Bro. A car floor isn’t even flat.)

Do you dig it ? A car floor is not fucking flat. That's why it's suspicious to remove the passenger seat without installing a flat surface over it. That's why the instagram poster did install a flat surface. Because they didn't want to sleep on the car floor. Because it's not flat. It's not comfortable. And because it's not comfortable it's not reasonable.

> As investigators follow Hans, they discover the missing CRX, but something is missing, says prosecutor Paul Hora. "He removed the front passenger seat. Then he completely disassembled, removed the rear cargo area of the car, threw away the carpeting that covered the spare tire and the cover that covered the spare tire."

> When it was Hora's turn, he asked Hans why he had removed the front passenger seat from his car. "He said he removed the passenger seat in order to make a Honda CRX a more comfortable place to sleep," Hora recalls. "His explanations were ridiculous. I mean, they were lies. A Honda CRX is an awfully small car that wouldn't be comfortable no matter what you did to sleep in it."

https://www.cbsnews.com/news/betrayal-29-12-2008/

> On October 11, 2006, law enforcement officials said that blood spatter had been found in Hans Reiser's house and car. Forensic testing (including DNA analysis) could neither confirm nor rule out Nina Reiser as the source of the blood. Officials had not located the missing passenger seat of his car. They also indicated that they had found in the car two books on homicide investigation purchased by Reiser on September 8 — five days after Nina Reiser's disappearance: Homicide: A Year on the Killing Streets by David Simon, and Masterpieces of Murder by Jonathan Goldman.[28] Daniel Horowitz, a high-profile defense attorney, joined the defense team[6] but dropped the case on November 28, citing Reiser's inability to pay for his services.[29]

https://en.wikipedia.org/wiki/Hans_Reiser#Murder_investigati...

It has never been mentioned that the car was modified to accommodate for sleeping on the floor in a comfortable and reasonable way. The passenger seat, carpeting were removed but that doesn't make the floor flat.

JFC.
> where keywords […] can be used as variable names

PL/I has that, too, because the designers thought you couldn’t expect programmers to know all keywords. For PL/I, that’s a correct assumption. Implementations can have hundreds of keywords, and some of them are single-letter (http://bitsavers.trailing-edge.com/pdf/ibm/series1/GC34-0084... pages 19-25 mentions A, B, E, F, P, R, S, V and X)
My own immune system is attacking my joints. Without treatment I'll be disabled within 10 years. What's your advice doc?
zuck won't puck.
So it's like the DEW weapons that can cook half a car in the twin towers parking lot and leave the other half perfectly intact...
Well, medical decisions are rarely that clear cut... the source of the bleeding spleen was unknown. All we knew is that he was bleeding out from his spleen and based on the volume of fluid in his abdomen, he wouldn't survive until tomorrow. It was "probably" a tumor, but the ultrasound was not clear and if it was a tumor, there was a 60% chance it was cancer. And we had 30 minutes to decide whether or not to take the surgical slot as they couldn't hold it beyond then... if we didn't opt for surgery we'd need to euthanize the dog.

So the choice was "immediate death or surgery plus a 40% chance of returning to normal".

After the biopsy came back and it was Hemangiosarcoma, then we opted for the experimental treatment coupled with low-dose chemo, which had a low chance of side effects that affect quality of life. The experimental vaccine was both to hedge our bets (it wouldn't hurt, and it could help, especially if he developed side effects to the chemo and we had to stop the treatment), and to give the company a little more data on the effectiveness of their treatment (even if we had to pay for it).

And indeed, he's had a good quality of life - he was fully recovered from the splenectomy in a week (though we had to keep him movement restricted for another week until the stitches came out), and so far he's 100% back to normal, showing no side effects from the chemo and his activity levels are still back to normal.
It grows by 2x for small sizes, then it transitions to growing it by 1.25x
They are very clever

That's all you need to know. "Why are all these very clever people doing X when they could be doing Y instead??" has a very simple answer: they've used their big brains to figure out that X is, in fact, a better and more sensible thing to do than Y. That's all. The powers that shape public perception of what constitutes meaningful work might not agree.
that's not exactly correct given the inflationary nature of printing to "spend into existence." History is filled with crumbled societies printing their own money as mention.
I'm not sure whether it's that easy. AFAIK he had a customer that wanted him to investigate why the customer's system was flooded with some data. He ran the connector to some other service that the data seemingly originated from and observed a connection being opened to a remote MySQL server in plain text in his firewall.
He took a look at this and saw that the credentials used were equal across all tenants of the MySQL DB. So it wasn't just his' customer's data that was exposed, it was the data of all tenants.
AFAIK he then created some hashes of user data and exported this, so he could report this to the authorities and give users the ability to check whether they were listed in the system that had to be considered compromised. The DB exposed data of around 700k end users. He also contacted the company that runs that DB about this issue.

The vendor of that connector then issued a new client that used TLS, which he also circumvented to show that the issue is still valid.
He is also accused of decompiling the client software to obtain the password. IIRC, he instead claimed to just have opened the file in notepad.
do it now.
Is it possible to do this system wide? Or do I have to do it for each individual service? It may be a trivial amount of work but if the configuration is fragile, I've gained nothing.
The actual quote:

> "Our long term vision is to build general intelligence, open source it responsibly, and make it widely available so everyone can benefit."

"responsibly" is a pretty important word there that the hn title leaves out. I'm not really sure how that would be possible with a true general intelligence give the alignment problem - it's not really clear to me there's any responsible way to build a true general intelligence with that issue unsolved.

For those that haven't watched his video interview, it's really great: https://www.youtube.com/watch?v=9aCg7jH4S1w - I highly recommend it to see how AI makes the low-fidelity stuff powerful (AR raybans) while the high fidelity stuff (VR) continues to improve.

I think it makes sense strategically for Meta to pursue the open version with licensing they control, the leak of llama was advantageous to them. If they have the dominant open model they're well positioned if the 'nobody has a moat' analysis is actually true. Not too dissimilar from their open compute server stuff, a bit of commoditizing your complement. If you have the data then the model itself is the complement?
See NixCon 2023, but also in general universities and student organizations in the country mandating that you pretend the defense industry doesn't exist if you want to have a presence there.

Just about anything German-hosted in the Fediverse is absolutely allergic to the industry and users will lose their fucking minds and hound you to the ends of the earth and send you death threats if you forget this fact.

Basically shitty ideologues who put purity ahead of the technology dominate every level of the discourse there. It wastes everyones' time and distracts from things that actually matter. In fairness, America isn't far behind.
The same logic applies to shutting down oil and gas production: if we are not certain, then why risk the downsides?

I’m not saying this is a good way to think, just that it shows the fault in your logic.