skysight-inc/HackerNews huggingface dataset:
The rotors will be unbalanced (even if the other side also broke off, chances of the same amount breaking of are as remote as the thing itself), so it will vibrate and probably tip over if it spins too hard
For anyone wondering "Why would you boot from an untrusted/compromised server?" or "Isn't this moot? If the server is compromised, it can just send a malicious binary." the short answer is:

The binary that the shim ends up booting has to be signed by the MOK. So it should continue to provide the same security guarantees whether you're booting from within a compromised network, over HTTP, or if you're booting from a compromised server (even if it's over HTTPS).

It's also important to note that secure boot doesn't prevent downgrades, so the fact that a compromised server could be utilised in a downgrade attack is not relevant. You would need to implement downgrade attack prevention in a more robust way regardless.

That being said, I don't know _why_ the shim needs to support http boot (after all, nothing stops this from being implemented as second local EFI binary which handles it and is signed by the MOK), aside from maybe that it was thought to be a relatively simple feature to implement.
Imagine we create an ai box and say that the box decides the results. It has been trained to judge those gymnastic acrobatics and is decision is final.

What will inevitably happen is a guy will come to the competition with a weird pattern on his t-shirt and get a perfect score without preforming any of the exercise.
I remember at work years ago hearing a little scream from the bathroom and it was because someone dropped the roll in and didn’t know what to do.

Lid’s always closed at home - I have a cupboard above the toilet that’s full of stuff likely to fall.
Show HN: Shipp, a deadly simple package manager for your C/C++ projects, in Rust
My partner died of cervical cancer at 30 years old. I'm now raising a toddler by myself.

Is this the place where I can tell you to fuck off?
If our brains evolved to be protected against man-in-the-middle attacks, that would be extremely scary because it would imply the proto-humans that didn't have this ability went extinct to some brain-invading predator!
These forced changes feel like adding a “disable ABS and traction control” button to a car. Great from the perspective of race car drivers. But my 70 years old parents ARE going to press that button and they ARE going to have a digital car crash because of this.

I’m already looking forward to the “I lost my bookmarks!” call because they chose a different browser and the “my battery is dying so fast!” call because they sideloaded the new Facebook app with unprecedented crap in it from Facebook’s marketplace.
But then don't pick the new terms.

If you want to continue to distribute your app for free in Apple's app store, literally nothing changes.
>In the British case, imperial power was used to abolish slavery worldwide on the basis of the principle of the fundamental equality of all human beings regardless of race, and also to offer the only military resistance to the massively murderous racist regime in Hitler’s Berlin

Britain’s role in ending slavery was something that was completely left out of my education as a child. Growing up in California we were taught a specific set of facts about slavery and it was very America-centric and particularly focused on the evils of the south and the brave abolitionists in the north. Especially the Underground Railroad. A more global understanding of how it came to an end and all of the history about the massive number of northerners who died to end the institution would have provided a much more balanced view. Looking back I can see that the people who made the curriculum I was taught applied a very specific lense to the historical facts.
Again the Big Five. Cronbach's alphas and intra-class correlations are very low too, which they do acknowledge. They further acknowledge that:

"A first consequence of using such a brief measure of personality is that we are unable to explore the relationship between particular facets (subtraits) of the personality dimensions and belonging [71]. As such, we don’t know if (or which) particular facets are driving the associations observed."
Android... before that, PalmOS...
It's funded by the comfortable margins on their hardware + the developer program fee. If the latter is somehow not big enough, they can raise it.
It was already hard to make money on iOS, especially for low priced apps.

This seems like it would completely eliminate popular ad-free and low cost free apps?
>I think perhaps notarization is OK, for example you have to pass requirements to publish on other closed platforms like games consoles.

In that sense, the old system is OK as well, no?
Well, we'll have to agree to disagree on this one; time will tell. Wish you all the best. Thank you for talking with me.
> they're asking Apple to spend all the engineering time developing APIs, xCode, etc. for free

I find such arguments more than absurd,

1. They have no issue doing that on macOS

2. Apple needs third party developers as much as the other way around. They are not doing this for free, they would sell a lot less devices if third party Apps weren't supported.
This. I've established security programs at 3 companies over 10+ years. I've rarely encountered an engineer who didn't care. I've encountered many with competing priorities.

What gets measured gets done. Establish the right measurement to equip engineers to prioritize security and they'll get it done.
Yes, if the attacker can edit the the victim machine's EFI vars or the contents of its ESP, then they can make the victim machine use HTTP boot even if the victim machine didn't use HTTP boot originally. However at that point they can also wreak more havoc without involving HTTP boot.

For the case where the default configuration has been set up to just chainload grub (ie what distros use shim for), and where an attacker editing EFI vars / ESP is not in the threat model, there is no concern. Yes that is just "It's not a concern because you defined it to not be." but that is the reality for most users of Secure Boot on Linux.

Also note that the reason I wrote that paragraph is because the HN submission was originally submitted with a title along the lines of "Every install of shim is affected".
Indeed this is something that has bothered me for 20 years, though significantly more so as phones have come to resemble general purpose computers more than just phones. Back then, I explicitly bought a Cingular phone instead of Verizon, because it ran a stock flavor of the Motorola OS, rather than the custom whatever that Verizon models shipped with which didn't let you install mp3 ringtones or j2me games.
It’s up from $100 USD, which is the yearly fee of a developer account. And you can choose the now-existing model, which obviously makes sense for a free app, so no, it stays 100.
Ah, game theory at its finest.
> Did they? Or did Adobe just stop offering #1, forcing customers into #2 whether they like it or not?

Completely agree!
I purchased CS6 around 2012 and use it to solve graphical tasks for a client even today.
I know that Adobes stock went up with ~25% (or was it more) when they announced the new subscription/robbery model, but I'm sure a lot of customers would like to do like me and keep getting value from the old investment by "owning" not renting CS<x>.

Only if you HAVE to be using the latest and greatest SW features, then the math might also work for the customer.

PS.: Too bad that my Macs are no longer able to execute CS6 as there is some 32bit code in CS6 and the newer Mac OS's only want to play with 64bit apps, that's a shame (but here Windows shine, by always(?) being backwards compatible (my client is a Windows business, so here that's not a problem…
tl;dr - "multiplayer web apps"

The technical specifics can follow.
I'd love to see how it performs in some benchmarks, specifically against Spider (https://yale-lily.github.io/spider) and BIRD (https://bird-bench.github.io/)
Lazy coding benchmark for GPT-4-0125-preview
OpenAI just released a new version of GPT-4 Turbo. This new model is intended to reduce the “laziness” that has been widely observed with the previous gpt-4-1106-preview model:

Today, we are releasing an updated GPT-4 Turbo preview model, gpt-4-0125-preview. This model completes tasks like code generation more thoroughly than the previous preview model and is intended to reduce cases of “laziness” where the model doesn’t complete a task.

With that in mind, I am benchmarking the new model using aider’s existing lazy coding benchmark. I've shared some preliminary results.

Overall, the new gpt-4-0125-preview model does worse on the lazy coding benchmark as compared to the November gpt-4-1106-preview model:

1. It performs much worse when using the unified diffs code editing format.

2. Using aider’s older SEARCH/REPLACE block editing format, the new January model outperforms the older November model. But it still performs worse than both models using unified diffs.
It would be fun to make up a physical version with lasers and a fog machine.
paying for what? for NOT using their infrastructure? it's not just crazy, it's criminal
You can get that for around $120 new.
That is the point. This is malicious compliance, presumably they expect to get away with it while the legislative/legal systems in the EU spend years grinding through the process of figuring out how to punish Apple for it.
While there were certainly closed phons prior to iPhone, there were also open platforms like Windows Mobile. You could run whatever app you wanted to on Windows Mobile.
Perfectly valid, I feel that way about all subscription-based non-ownership — I want to buy a thing and have it and "they" can't take it away from me.

On the other hand, I'm old enough to remember when operating system upgrades were around 10% of the price of the original computer (for each upgrade, about once per year but not at all regular), and when I couldn't afford a compiler.
But look at Windows and Android… you end up paying somehow in the end anyway.

Microsoft updates Windows OS for longer than Apple updates MacOS or iOS, despite charging a one-time fee that most end-users don't pay themselves.

And is backwards compatible.

And works with 99.999999% of the computer hardware ever made.

It seems like with Apple, you're just paying for a lot of nothing.
Assuming body has header, main, and footer...

body {

display: grid;

grid-template-rows: auto 1fr auto;

min-height: 100dvh;

}

main {

display: grid;

align-content: center;

}
> Likewise, is there any technical reason why Tesla can't let you sideload any app on the car? No. But Tesla doesn't let you.

Cars are effectively bullets, they can kill people, so you can't just install anything in a car. I'm sure there's plenty of laws requiring Tesla and other car manufacturers to lock down car software.

(Just like there are laws requiring phone manufacturers to lock down phones - you can't just install an app that lets you override the GSM protocol and mess with the spectrum, not even on Android!)
I would save a lot of time using that tea set with high throughput spout. I remember filling a huge pot in a waterfall sink that gently dumped a shit load of water and being very pleased at how fast it filled with very little splash back.
Cert is invalid, HSTS is enabled, HTTPS is forced, can't visit that site.
Which can be paid for by selling hardware devices.

The world does not own Apple any level of profit.
Bunch of guys justifying price of overpriced cable and comparing it with regular usb cable as it was apple to apple (see the pun here? ;-) ) claiming that they are advertising something else :-)

Putting aside everything above - making an every day use cable cost 130USD is not an example of good engineering, it is example of very bad engineering.
These modern days I'd personally skip over flexbox and use CSS Grid. I find grid-template-areas such a nicer to read map than trying to decipher complex nests of flexbox and I'm finding more every day that I prefer CSS Grid even in places that don't seem to be 2D layouts yet and could just be 1D flexbox.
And how to be part of the 1% who succeed
Malin sues Facebook: – David against Goliath
We seem to be losing the definition of words. From "perfect phone calls" to "perfect landings" just feels like moving the goal posts. Let's tone down the rhetoric a bit. A very successful landing. sure. Met all of the necessary goals even if wasn't as designed. sure. Perfect landing. Let's not be silly
So, it still landed, upright no less, with a piece of the rotor blade missing?
I'd guess that when a piece of rotor comes off during flight, the imbalance would make landing impossible. Very curious to what happened, but probably we'll never know exactly.
> there is no local sympathy like in the Epic case

Epic is in no way more "European" than Apple.
Big discussion here: https://news.ycombinator.com/item?id=39132453
In 1993, to Richard Garriott, for just $68,000: https://www.space.com/8073-privately-owned-soviet-moon-rover...
> So this is essentially Apple making the alternative so unappealing that no-one will switch and status quo is preserved.

The new terms are very appealing to the vast majority of developers. Most of us don't have 1M+ installs a year.

They are unappealing to the likes of Facebook or YouTube.
Seems like apple worked around the law but EU won't stay idle on this.
And? Other’s shitty shady app store would never have been a good thing - now it is just gonna be financially disincentivized.
Translation by Google from norwegian to english:

https://www-nrk-no.translate.goog/trondelag/malin-garberg-sa...
They were explained clearly in the article I found. Although those last three are self-explanatory if you know what the individual words mean, they’re in the dictionary.
Am I supposed to assume this is a bad thing?
And more: no game developer is forced to publish on Steam. Anyone can sell directly to customer, directly installing their games. But people choose to publish on Steam because it adds value to gamers and developers. On the contrary, what Apple does is something between racketeering or extortion, only possible thanks to them having the only key to the gate.

Boo, Apple.
Not to mention that California essentially has had GDPR rules for the past five years now. Are these non-profits also not operating there?
> An application that has permission to map memory pages as executable is a coveted target for spyware and malware as it provides a much better starting point for pivoting to root and pwning the entire OS

No more than any other app. It runs anyway in the app sandbox, and can only access the resources that are accessible from the app sandbox itself. For the application to gain root privileges it would need to exploit a flaw in the sandbox itself, something difficult these days.

Android allows applications to map memory pages as executable (in fact you can also launch any Linux executable as a subprocess) and there was never an issue about security: if you don't have a rooted phone you don't have chances to get code running as root, since everything runs in the app container.

And if there is a flaw that allows escaping from the app sandbox, it can probably be exploited without being able to map memory pages as executable anyway, since it will probably be a flaw in a kernel system call or library function.

So really: this was always a limitation that Apple did impose to not allow in practice competing browsers in the Apple store, since a browser to be efficient this day needs to compile code as JIT, as well as not allowing applications that benefit for JIT execution (such as emulators or compilers).
> You don't relearn how to drive when you get into a new car.

These days you do. We're at a transition these last 10 years or so as great as the one from crank-start to key-turn start cars, from regular steering to powered steering, and from manual to automatic transmission.

Even back a couple of decades ago I remember my 1980's Buick having shifting on the steering post toggles versus my 2000's Saturn having a standard shift stick.
Ukraine energy firm, postal service among state agencies hit by cyberattack
If Apple inexplicably chooses to sell iDevices so cheaply that they can't afford to pay the people who build the software for it, that's their mistake. The EU isn't forcing them to do that, neither are app developers. They've had years to remedy any pricing mistakes they made in the past and price their hardware appropriately.

They also pull in billions of dollars every year from their 30% cut on gambling/gacha games, and do almost nothing to earn that (those games have to provide their own updater/CDN because the Apple/Google ones aren't good enough, and those games don't meaningfully rely on Apple/Google for things like quality assurance or marketing.) Apple will be fine even if their Europe-specific cut is halved.

Claiming they're going to suffer or be unable to pay employees is simply not supported by any evidence.
Yet they basically monopoly in the datacenter GPU/AI market mainly because of software.

> Some market segments even spend thousands of dollars in Nvidia's hardware

What segments are those?
Oh but trust me this is "for your own good".

- signed with love, The Corporation.
You don’t have to sign up for an account, an app can install some type of opaque object in iCloud that they can use to identify someone who uses their account.

If I delete Overcast from my iPhone or install it on a brand new iPad, all of my data is kept in sync. That data is stored in a database where the user id is that opaque blob.

Marco Arment (the author) does all he can to discourage users from storing a user name/password/email address as part of the login and only requires you to have one to associate your user to your account to access your podcasts on the web.
Hmm. I also thought the type confusion in 518 was the same one from the blog post, but looking at the patch, it's not either. I think I stand corrected overall.
My testing on the older `gpt-4-1106-preview` model seemed to show that these sort of "emotional appeals" actually hurt GPT's coding performance. GPT-4 Turbo did 4-12% worse on the benchmarks when similar concepts were added to the prompt.

https://aider.chat/docs/unified-diffs.html
I like it to get off the ground, then when I've got something that sort of works I read through all the relevant register descriptions until I understand every bit.
A lot of sensible regulation provides escape hatches for smaller companies to avoid the huge costs of compliance. The exception is where there should be absolutely no exceptions, like medical regulation or privacy.
Better investment than an NFT, at least.
Mojo SDK v0.7 Released
The reviewing process done by apple still applies to them.
The horrors of PXE? Where you end up with a clusterfuck of DHCP and TFTP to load the correct image?
I suspect we should be blaming the diplomats and the national leaders giving them orders, who should be responsible to the people, not the UN bureaucracy or the people who work there that doesn't actually that much decision making power AFAIK.
Any link for the "OXYO one"? I can't seem to find it.
Mabez Rust on Espressif chips – Q4 update
> Speaking of commissions, remember that Apple receives a 15% or 30% commission on the subscription revenue from Hyperweb and Insight Browser. In fairness, however, we can't begrudge this commission, since of course Apple has to pay expenses for important upkeep and maintenance, such as… App Store editorial?

Kinda short sighted. Aside from editorial:

- Overhead of support (cancelled subscriptions, subscription refunds - for example if you forget to cancel, apple will refund you). It costs money to pay people to do this.

- Fraud (for example, people using the app store to launder money, requires hiring teams). Also app screening. It costs money to pay people to do this.

- Card transaction fees (baked in and not insubstantial)

- Bandwidth (using App Store to push updates is not free!). Managing infra as well. It costs money to pay people to do this.

- Free apps (your 15-30% is being used by Apple to subsidize free apps)

- Development (the App Store, updates, app packaging). It costs money to pay people to do this.

I actually do agree with Apple that they should be allowed to charge a substantial percentage to cover costs (and some reasonable profit). I do think a lot of the above costs should at least partially be paid by hardware cost, but that's a hard ask for long tail devices.

To be fair: 30% is insane, and I'm glad that they're getting serious regulatory and legal pressure around this. I'm not sure what their break even point for revenue is, I'm sure someone would be happy to educate me.
Yeah. It's not fair to judge Microsoft for people abusing the API, but that's a different question from whether or not they should lock it out. That would be a big freedom reduction, and even though I'm sure it would make life slightly easier for for some parts of Microsoft, I'm pretty sure it wouldn't be for the best.

Going to the game console example, blaming Nintendo for the botched upgrade is dumb, but what if Nintendo puts security keys in every component to prevent repair? Yeah, it's fair and good that they foiled the 3 modders who bricked their devices and tried to claim warranty, but they also sent 3 million extra devices to the dump that otherwise could have been fixed by enterprising teenagers with soldering irons. It would be 100% fair to blame them for that.
Selling devices and App Store revenue. To charge free/open-source apps for your OS is absurd.
I have a free utility app for school kids with an install base in the multiple millions. I don’t make much off it, but many users find it helpful. It’s most popular in the EU.

So… if I’m understanding right, I need to take the app down, or start charging an up front fee to school children? Nice one Apple. I hope I’m allowed to add a pop up explaining to users why the app will now incur a mandatory charge.

The best way I can interpret this: it only applies to new downloads each year. In that case, it’s still concerning —- what happens if there is a surge of downloads? I’m on the hook for $50k overnight?

And if updates are included in this number like some comments here suggest, users aren’t going to get any bug fixes.

Wow. HN, please tell me I’m interpreting this wrong.
What kind of "onerous regulation" are we used to, exactly?
Yet Another What Is the Fediverse Post
> there isn't that much to learn to understand C

Man, what a bold claim. I could say all kinds of things about the number of books written about C, the size and complexity of its compilers, the failure of even veterans to avoid mistakes, the constant disagreement amongst even experts about the most fundamental things like realloc, but my only argument--indeed the only argument I need--is that the standard [0] is literally hundreds of pages.

> pointers aren't complex

Pointers are so complex they're responsible for the vast majority of security bugs across all of computing history, and they're so powerful and overloaded that they can't be fixed without bonkers hardware interventions like CHERI. You might say, "nah it's buffers" but when you have a pointer, everything is a buffer! You might further say "nah it's random undefined behavior", but it's very, very hard to use a pointer without invoking undefined behavior. Here's a quick thing I googled:

int func(int **a)
{
*a = NULL;
return 1234;
}

int main()
{
int x = 0, *ptr = &x;
*ptr = func(&ptr); // <-???
printf("%d\n", x); // print '1234'
printf("%p\n", ptr); // print 'nil'

return 0;
}

Did you know that the language doesn't specify whether the deference on the left of `*ptr = func(&ptr);` comes before the address-of on the right, thus this behavior is undefined? Can you really be arguing that this isn't complex?

Look I love C, but it's deeply complex and a lot of that is pointers.

[0]: https://www.open-std.org/jtc1/sc22/wg14/www/docs/n3054.pdf
Ironically, my Brother laser printer required a firmware update to get AirPrint to work well.