skysight-inc/HackerNews huggingface dataset:
> Someone with enough privileged access to write to the ESP (ie root) can also add their own MOK to the ESP that the user might blindly accept next time they boot. Especially if they time it for when there is a legitimate new MOK in the ESP waiting to be accepted on next boot, so that the user is predisposed to accepting a new key.

> They can also replace shim with other binaries with other vulnerabilities that were signed by the MS key in the past, in case DBX hasn't been updated with their hashes.

Neither of those sounds like a sure thing. The first relies on the user not checking the key, and is exposing the attacker to a lot of risk if they do. The second relies on DBX not being updated, for which the remedy is "don't do that".

> Someone with enough privileged access to write to the ESP (ie root) can also just exfiltrate your disk contents at that point.

The idea is that your main data partition is encrypted with a key held in a secure enclave and can only be retrieved after a secure boot. (Or, y'know, any of the other things people would use secure boot for). Your boot partition has to be unencrypted so you can boot from it, but there's no sensitive data on there, and an attacker with write access can't "rootkit" it because if they replace the bootloader with a different one then it will be unsigned and break the chain of trust. Again if this stuff didn't work then there would be no point in secure boot at all.
British man acquitted over Snapchat bomb hoax
Docker didn't bring container running features or kernel features for running containers (they just used LXC at first didn't they?), Docker brought an image layering and distribution set of features for single process containers.

OpenVZ (like LXC) was more of an OS level VM alternative type of container. Docker was more of a developer oriented distribution/isolation system than OpenVZ/LXC/etc which were more of a sysadmin oriented hosting system. In the very early days Docker didn't make much sense to me until I realised that.
It just tends to be very snarky and condescending. Many of their articles are editorials disguised as journalism. Obviously, it's hard to find any objective news sources nowadays, but FT feels especially ranty. Also, their paywall is especially frustrating since it doesn't even let you read the lede.

EDIT: To reiterate, Anjana's article was good. So this is all just personal opinion. I should probably give FT another look.
I have the 1924 Bauhaus chess set and it's the most beautiful thing I own.

Always loved how the shape and size of the pieces indicate their moves while still being simple and recognisable.
They definitely consulted a bunch of lawyers. The App Store makes on the order of $100B profit annually. Given that, a reasonable budget for consulting lawyers - on a matter which may result in them losing a substantial amount of that profit - would be massive. Even $1B in attorney fees would be a tiny price to pay to protect that.

Yes, we know they talked with the EU, but we don't know the content of those discussions. It's easy to assume they were checking whether their proposed implementation would satisfy the regulators. It's equally likely, even more likely, they were gathering information, posturing and probing to see how the EU would react, to gauge how best to craft their scheme to outwit them and what they could or could not easily get away with.

You can hold a negotiation and still screw the other side over afterwards - isn't that actually the best way to do it? Holding a meeting first to learn what cards your opponent has in their hand is just a better way to play any game.
Most people think of the knight move as one straight and then one diagonal. However, this is still ambiguous. Imagine one up, then one down left for example, resulting in the square left to the original square.
A better description is moving 2 squares straight, not diagonal, into one direction, then moving 1 square into a 90° turned direction.
Game consoles should be also. So, you're asking the right question but I hope you're not trying to make the point that Apple shouldn't be.
I'm sure it was even worse before, but I'm not entirely happy with the look of that.

* I shouldn't have to care where the certificates are stored. Just load the os default ones without asking me.

* I shouldn't have to know what a pem is, and I shouldn't have to open() one.

* I don't want a PolicyBuilder. Just give me the normal policy.

* I shouldn't have to construct some verifier object specific to a given dns. I don't want to verify a billion certificates for one domain, just one.

* I shouldn't have to know what an untrusted intermediary is.

Here's what I think it should look like

verifier = Verifier() # constructs a verifier with sensible defaults, overrides are possible though
verifier.verify(chain, "cryptography.io")
According to [1] the estimated number of iPhone users (leaving out any Mac users) in 2024 is 1.46 billion.

[1] https://www.bankmycell.com/blog/number-of-iphone-users
does this imply an image-to-text keyword and automatic escalation system from Snapchat? or perhaps someone just reported it...
Yep, there's a comment at the bottom in which the author admits that, after further testing, it doesn't actually work.
To add to that, this also makes a knight and queen a very strong attacking combo, because they can uniquely cover the most squares.
On the bright side, I wonder how many new studios will spawn out of this?
Lenin "He who does not work shall not eat"
There exist free apps that Apple doesn't approve of in it's store.

And there are also free apps that might want to be distributed through Apple's store alongside an alternative store, which would require them to accept the new terms, as far as I can tell.
it's just the distribution. why does that make such a difference to your experience?

to me, i see the app store for 5 seconds between clicking a "download" link, pressing "install", and closing it.

on my computer i don't care if spotify publishes their desktop app through the apple store, their own website, command line, or some other thing. i trust it because the download link comes from spotify's website, that's the source of authority. i don't care about the thing in between clicking download and having it on my device.
These numbers smell like there’s at least one faulty assumption in there.

A) How much of this debt could have been avoided with industry best practice as now understood?

B) how much of this debt could have been avoided with industry best practice as understood when the software was written?
From the quote in the article about paying back technical debt: "Technical debt accumulates when decision-makers opt for a short-term solution to a software development problem rather than a more comprehensive long-term solution. This initially hides substantial costs that organizations must later pay."

One thing to keep in mind is you don't always need to pay this debt back. For instance - what if you want to try a quick prototype of something (which may later be discarded if it doesn't pan out), or just need a temporary stopgap solution?
Apple's profit is definitely public information since they're a publicly traded company. In 2023, they reported $97B in profit.
Data-Ink Ratio
I wonder if there is a concept of infinite length SQL tables. Not sure what would happen with:

ORDER DESC
COUNT(*)

I can't find anything after a quick search except recursive views that must terminate (therefore aren't infinite)
From the developer perspective, that is a big component of store quality.
My commute is about 20 minutes on bike. At -35 C I passed 5 cars in parking lots with the hood up and in best case jumper cables from neighbour cars. There were a lot of cars that just didn't start any more.
It's more likely that they felt the cost of challenging this was worth it from a cost/benefit standpoint.
[Author here]

It is overlong, sadly, yes. It was written in some haste, despite considerable planning -- see my docs uploaded to the Internet Archive, for instance -- because one of my planned, agreed interviewees for Retro Tech Week dropped out at the last minute and left me without an article, and I had to rush this.

Je n’ai fait celle-ci plus longue que parce que je n’ai pas eu le loisir de la faire plus courte.
I'd argue that Android is much worse than Windows.

all legitimate Windows devices actually get updates.

kernel exploit on your Android phone? welp hope your oem does something
I had a similar idea: https://imgur.com/a/MccC29V
GitLab CI is great, I've seen CircleCI used a lot.
I hate to break it to you but, the city grid plan is ancient. The Greeks and Romans used it, even the Pre-Columbian Americans had it.

The system is great for directions and general movement of people.
I'm sure they did but Apple also Apple is having trouble selling Apple Watches with O2 monitors due to legal reasons.
How many trillions of value was created by taking on 1.52T in technical debt?
I'm with you at least 2/3 of the way. My preferred stack is PRQL + DuckDB + Dagster. I evaluated the space for work at my current company (was originally only DE, handling ingests from ~300 sources across various systems, on order of ~1k downstream tables in dbt + hundreds of dashboards + a handful of business-critical data+app features; now leading a small team).

I came away ranking dagster first, prefect second, everything else not close. IMO dagster wins fundamentally for data engineers bc it picks the right core abstraction (software defined assets) and builds everything else around that. Prefect for me is best for general non-data-specfic orchestration as a nearly transparent layer around existing scripts.

Ofc to each their own based on their usecase.
In a nutshell: it's war from day #1, the only advantages you have is that you are more nimble and have less burn so changes in conditions will work to the detriment of your opponent. But they likely have more capital and a solid revenue stream as well as more mindshare with their customers.

If you ever plan on going head to head with an incumbent I'd take a leaf out of the playbook of the flea, find a single customer somewhere that you are going to make totally happy whilst conserving those two advantages, keep your burn down and focus on the speed of your turnaround in the interaction with the customer. Then, when your customer runs out of ideas for you to add to the package generalize as much of it as possible and pull in customer #2. Never retire a feature that you built for someone else but do focus on the emerging 'core platform' of features, the overlap between your customers and move peripheral stuff into its own environment (in software: a separate repo with customer specific stuff).

With a more physical product it's going to be harder (but then, everything is harder with a physical product) so you'll need to either go slower or have deeper pockets.
No? They are cleaning up after their merger.
There is zero chance of India joining NATO in our lifetimes. They have an entirely different set of priorities. At most we might see some limited defense cooperation agreements between India and other maritime powers to secure their sea lines of communication and contain Chinese expansionism.
Cool. What's the opportunity cost to fix it?
Here, let me help you with that...

O7
/|
Λ
And how can consoles get cuts of revenue when games are sold? It's all about licensing and contracts. Why does Epic get 5% on every game sold using their engine? Same reason. How can publishers sell licenses to libraries with a fixed number of checkouts and time? Same reason. And, this is the reason Apple will point to when demanding their 30% or per install fee.

PCs are the exception in this world.
No problem. The old viruses will not run due to missing libraries.
Knight's movement is a "Γ" "Gamma" not an L. Some day a brilliant game may pop up, which has several letters and try to match em together, like an L, a Γ, an I and so on.
If you can find specific numbers on Apple's profit from the App Store, I would be very interested to see them. Of course Apple's total profit is public information, but they don't break it down so specifically. The best I can find is that App Store revenue is on the order of $100B, but the profit margin has not been disclosed (though speculated by Epic to be ~80% [1]).

[1] https://www.marketwatch.com/story/how-profitable-is-apples-a...
A good Groovy script limits itself to running scripts in better languages.
Honestly, sounds low. Technical debt is just like real debt: a useful tool to allow you to borrow against the future to get things done today, and an existential threat if not serviced before it gets out of hand. A tool that everyone else is using to the hilt and if you don't you'll be at a severe disadvantage. If it accumulates, it can sometimes be cleared down to a sustainable (and even useful) level through a painful multi-year process where no-one is having fun and you don't get to do many nice things you thing you should be able to.
Apple Safari 17.4 beta includes VP8/VP9 and WebM support on iOS and iPadOS
Reasons to Celebrate the 6502
and it's not just that

to the bankrupt startup, the difference between $5m of tech debt and a perfect codebase/architecture is precisely 0. they're bankrupt either way

racking up tech debt is a necessary strategy at certain points in most companies' lives
Disagree. CRDT is pretty much a word at this point, searching for the acronym will get you more useful results than expanding it.
Hasn't happened on Android, won't happen on iPhone. It doesn't make any sense.
What a terrible article. This one limits the puns to the opening paragraph and actually explains the issue:

https://www.theguardian.com/business/2024/jan/19/walkers-min...

If it quacks like a duck, it's taxed like a duck.
Oh is that what GP meant by “truly free”? I thought free as in free beer.

Yeah GPL licenses are not allowed, at least from GPL2 onwards.

Then again, FOSS can get a CTF exemption if they form a nonprofit.
If several of these could be looped together, could you get a structure stronger (or at least more resilient to tension) than carbon nanotubes?
I'm actually curious whether they're going to allow non-notarization apps to be installed, but keeping it hidden away.

But any developer distributing non-approved applications won't ever be allowed to distribute on the app store as well without paying those fees.
You're absolutely right about that - power banks that don't have that momentary cutoff are rare and would be highly sought.

However, vermaden is powering a small form factor computer that appears to be able to take anywhere from 12 to 19 volts. This means the power is internally regulated, which means that there's at least some amount of capacitance in the regulation circuit. Many devices like these can handle a drop of power of a small fraction of a second, but likely not more.

For my own SBCs, a rather large capacitor made a power bank I was using work, but the size of the capacitor was unwieldy. I'm more inclined to use an all-in-one charging and battery circuit that feeds the SBC directly.

I'm surprised there isn't already a market for power banks without momentary cutoff. There's quite a market for UPS Pi hats already.
A LOUD THANK YOU.
Well played CCP, well played.
I think change out \/ for:

■ ■
P

And the knight for:

■ ■
■ ■
N
■ ■
■ ■

And you might have something a little nicer
> Beginner users are also very good because they do stuff you never expected.

People using software for a while undergo operant conditioning: consciously or subconsciously they quickly learn to internalise what makes the software 'angry', and learn to avoid that. That makes them more productive users, but also less useful as explorers.

See https://blog.regehr.org/archives/861

> Have you ever used a new program or system and found it to be obnoxiously buggy, but then after a while you didn’t notice the bugs anymore? If so, then congratulations: you have been trained by the computer to avoid some of its problems. For example, I used to have a laptop that would lock up to the point where the battery needed to be removed when I scrolled down a web page for too long (I’m guessing the video driver’s logic for handling a full command queue was defective). Messing with the driver version did not solve the problem and I soon learned to take little breaks when scrolling down a long web page. To this day I occasionally feel a twinge of guilt or fear when rapidly scrolling a web page.

> The extent to which we technical people have become conditioned by computers became apparent to me when one of my kids, probably three years old at the time, sat down at a Windows machine and within minutes rendered the GUI unresponsive. Even after watching which keys he pressed, I was unable to reproduce this behavior, at least partially because decades of training in how to use a computer have made it very hard for me to use one in such an inappropriate fashion. By now, this child (at 8 years old) has been brought into the fold: like millions of other people he can use a Windows machine for hours at a time without killing it.
Because you want to play Valorant, that's why.

This is like when a guy said to RMS, "I have to use proprietary video editing software to do my job" and RMS was like "Then find another job."

IF LINUX CANNOT RUN THE SOFTWARE PEOPLE WANT TO RUN, IT IS A POOR OPERATING SYSTEM.

We've been telling open source folks this since the 90s. It's time for them to listen and learn.
Technical debt is the term midwits use to describe bad code.
What led to you making so many changes to your normal routine all at once?
Nobody wil accept the new terms until the EU slaps the hammer on Apple once again.
Agreed - I keep a T23 as a distraction-free writing machine.
Not sure. Perhaps Leeloo Dallas is between the drives.
I was around but very young and not working in Silicon Valley proper. I think my first tech internship was just a year or two after that, can't remember exactly.

Never really had trouble finding work on the West Coast since then though. This year, I was unemployed for half a year (after quitting voluntarily) and finally found work with a European company. Guess the boom times are over! It's AI or bust now, lol (and I have neither the skills nor the interest to work in ML).

Keep in mind though I'm also a nobody, some rando self taught web dev coming from the LAMP world into React. We're pretty much bottom of the barrel as far as programmers go, so I'm not surprised I'm not a competitive candidate! I love the frontend, but more for its visuals and UX than coding. It's a very far cry from AI or algorithms or really any sort of non visual coding.

The kind of I stuff I used to get paid for when I was younger, Wix handles effortlessly now (and I recommend it my clients too... don't pay me, just make it yourself on Wix in a few hours). React's probably headed down the same path: https://v0.dev/
That’s more like playing it safe until there is a definite ruling.
Not to mention cats knocking jewelry and phones in for a laugh.
A simple non-subscription paid app (say €2.99) makes way more sense, and you almost certainly won't have to worry about ever reaching a million installs.
Here is Scott Manley's great discussion of it:
https://youtu.be/7bFiJvbKyPs?si=EPXhBYba3XnQN1YB
I’ve met Elisabeth, and i think she’s a fantastic thought leader for exploratory testing.

Sadly my efforts to promote this practice were met with a dismissive response: “QA leads to lower quality, according to this study”. I just didn’t have the energy to try to change this person’s opinion.

I have seen exploratory testing in concert with good developer testing work extremely well. Old school SQA isn’t really my thing, but modern exploratory testers are tremendously valuable.
So if I develop a Catalyst app for an M1 powered Mac I can distribute it outside of the Mac App Store, and freely use Apple's SDK (as long as I pay the yearly 99 fee to enter their developer program).

But if I distribute that exact same app on an M1 powered iPad outside of the App Store, I'll be subjected to a fee if my app goes viral, unless I agree not to profit from it and set up a non-profit organization?
I certainly don't, mostly because I want to pay the artists I appreciate. But also, the sound quality is awful.
Whether runtime generated or downloaded from the internet, you cannot run instructions directly on the processor without requesting executable virtual pages in memory from the OS. Executable pages are also a major security vulnerability: https://en.wikipedia.org/wiki/JIT_spraying
Attempting to be more inclusive about the types of models they feature.
"For every software install" is very different from "for some preinstalled or promoted software".
I haven't quite had 'nuclear' but I know what you two are talking about. "But we would have gone out of business 3 years ago if that weren't written!"

Yes. Three years ago. And it's not three years ago.
Given... they stay... in the same... square?
Because under the DMA rulings they do not qualify as Gatekeeper Platforms IIRC
Nonprofits are explicitly exempted from the fees. An fdroid like app store seems quite possible.
This routine acquisition BS and has nothing to do with LLMs or the economy. Bloodbaths after acquisitions are the norm.
Not sure, I would love to see it too. I bought some things on Vimeo over the years which does offer DRM-free downloads (if enabled, otherwise yt-dlp is your friend), but it's really just some indie and crowdfunded projects.

I guess the industry thinks pay-per-view platforms like Amazon, YouTube, etc. are good enough?
I see the "app subscription in 1 place" point a lot, but what stops you from only ever enforcing that rule by yourself, as you're already doing now ?

I assume that means you currently don't subscribe to anything Amazon provides, nor Netflix, nor game services, nor newsletters, nor coffee subscriptions etc.

A few more subscription mechanisms appearing in the world would not make a difference, do they ? I anything you'd have more option to choose which basket you put all your eggs in.
Private equity worries climb as investors increasingly claw back incentive fees
Slashdot gets a not-insignificant portion of its content directly from top HN posts. That's what led me here to begin with - almost all of the reddit, slashdot, and other aggregator content I liked was being sourced here (with Phys.org being my second favorite source.)
Johnson was quite the man for the pithy quote.
The article mentions the Flynn effect but I don't understand their point.

If there's a 3 point per decade increase then the average college student today would be smarter than in 1939.
Why is this "one-dimensional" rather than just a tube of 1-atom thick gas? Is a string of pearls "one-dimensional"?

It's very cool that they pulled off working at an atomic scale like this, and amazing that they visualized it.
During USB-C debates, Apple reportedly tried to circumvent EU regulation and got an explicit public warning from EU commissioner who read the secret plan from the media outlets. Then they retracted their MFi for USB-C plan.

I'm reasonably sure Apple didn't reveal most of their compliance plans to EU, since they will ask Apple to implement the most strict interpretation of the regulation and it would be headaches in the court if there's any evidence that Apple knowingly ignored such requests.
Not always. Sometimes you take on debt to ship faster. The same way you take on debt to grow a company faster.

Bad code is often just careless or inexperienced developers producing low quality with now real upside to the company.