skysight-inc/HackerNews huggingface dataset:
> That's why I qualified it with "certificate-based". The private key never leaves the device

Except that phishing doesn't require the private key - it just needs to echo back the generated token. And even if that isn't possible, what stops it obtaining the session token that's sent back?
Show HN: I made a product to automate subtitles
We have identified an issue in the automated subtitles landscape: the market is saturated with complex and overpriced solutions. In response, we developed Textualyze.

Key features include:

Link uploads: We support most social media links.
Longer uploads: We offer extended video exports of up to 20 minutes.
More affordable pricing: Compared to our competitors, our services are significantly more cost-effective.
User-friendly UX/UI: Our design is simple and straightforward, with no credit card required for the free plan.

Textualyze was created using OpenAI's Whisper and Remotion.

We're interested in hearing your thoughts.
The best part is it works pretty great on mobile. Really amazing stuff. Love photopea!
OpenAI and Microsoft reportedly planning $100B project for an AI supercomputer
Several mentions here of using overlay file-system via the RaspberryPi specific raspi-config options.

However, where-ever systemd is the init one can do it via adding to the kernel command line

systemd.volatile=overlay

"If this setting is set to "overlay" the root file system is set up as "overlayfs" mount combining the read-only root directory with a writable "tmpfs", so that no
modifications are made to disk, but the file system may be modified nonetheless with all changes being lost at reboot."

See man 7 kernel-command-line for the other volatile mode options.
Accidentally committing it.
> When using binaries, you can let Linux Systemctl handle the process

“Systemctl” instead of “systemd” ? Hm, do I detect reticence to publicly admit the undeniable, vast superiority of systemd by confusingly using the name of the utility?
When I was setting up one of these $5 per month services(a simple php Web shop, with shopware if I remember correctly) I tested it with 10 concurrent users (5 req/s or so on average) and the $5.5 per month instance handled it just fine.

Yes, the instance had docker and was in an auto scaling group to be rebuilt if anything fails. There were 3 containers running with strict mem/cpu limits. Nginx reverse proxy (all in 128mb of ram), a mariadb sql server with a minimum of ~300mb of ram and up to 512mb if available and the php/Web host with 512mb ram reserved.
Mariadb was tuned and shopware was tweaked, but that's about it. Everything run fine on a 2 core, 1gb ram instance. (has, not "has been" because a year later the shop closed for other reasons). So the morale of this story is, sometimes a $5 vps or an instance is the correct answer.
Not all government employees are equally capable.
Or do both, because it also turns out that Rust build process is a real joy compared to that of C/C++ [1].

[1] Except when there are C/C++ dependencies :-)
It would appear that no one knows the RL identity of the bad actor? Or even vouches for them?

It doesn't seem wise to accept contributions to projects which may have security implications from anons. Code contributions clearly can't or aren't independently validated.
Indoor airborne risk assessment in the context of SARS-CoV-2
He is Taiwanese. At least he posted on Taiwanese boards.

Jie would be female, Jia male
Thanks for the reply. I see that "repository delegates" is a git-versioned list of public keys corresponding to approved maintainers. So it looks like a fork taking over an abandoned repository would have to use a slightly modified URL to access [0] (until the original maintainer comes back and adds the new maintainer to the delegates list, then the new maintainer can merge the repositories). My confusion (your so-called "popularity contest") came because I read how the "canonical branch" is determined based on consensus of signatures, and I didn't realize that only the pre-approved keys could contribute those signatures.

So, anyone can make commits and seeds will accept the commits from anyone, but the "canonical branch" will only update (on a given seed) if it's signed by repository delegates. The "next strictest" level of control is private repositories, which simply means that Radicle will only send its commits to a peer in the repository's allow list.

My next big moderation-related question is what redaction looks like. Obviously an unwilling peer would diverge from the signature chain at this point, but does Radicle provide any tools for, say, permanently redacting an issue comment? It's obviously possible (but painful!) to do this in regular git for commits.

[0] https://radicle.xyz/guides/protocol#git-url-scheme
The Taiwanese government funded the project and certainly contributed to unblock problems, but why are you singling out in this case the importance of funding and who are the investors in detriment of who is actually making things possible?
Note that if you just want to provide a issue tracker within Git rather than relying on centralized web services like Github or Gitlab, there is

https://github.com/MichaelMure/git-bug

https://github.com/dspinellis/git-issue

https://sciit.gitlab.io/sciit/ (this one has a list of alternatives here https://sciit.gitlab.io/sciit/#other-distributed-issue-track...)

Overall it's very disappointing that Github didn't decide to embed issue tracking (and also PR discussions) inside the repository (in another branch perhaps). Issue discussion is part of documentation IMO, and not distributing it alongside the repository causes lock-in
My only memory of playing Far Cry was struggling to get the demo to run at all.
it's just an arbitrary section of libcxx-18.1.1/lib/libc++abi.so.1.0
It's a giant checkbox in the browsing settings...
Isn't it rather that the attacker can log in to the compromised server by exploiting the RSA code path?
Or 386K requests per seconds, depending on where these billions are coming from :-)
Exactly, the same way that "the cloud" is just someone else computer and responsibility.
Anyone know if Homebrew is impacted? I literally updated yesterday.
I think the self congratulatory tone is just them saying if you design things simply you can do a lot (load) with a lot less (people/complexity) and still have an app that’s resilient (ignore minor ddos issues).

It’s encouraging or reminding people that this style of architecture, which was once prevalent, is still an option and is still rather legit.

Or, that’s how I read it however I also am biased as I prefer this method of development too. I think what’s missing in the article is, who are they and who is the audience. As in, some acknowledge that most things are not ever going to see mass scale usage and don’t need to be developed to the specs of a faang
Consider removing autogenerated files from tarballs
No, it's a fact at the mathematical level that you can enshrine in big O terms if you want to
Metascience of the Vesuvius Challenge
Last time I tried it, it was ios only and the projects it suggested were pretty simple. I found that just building something was more enjoyable every time.

It's a neat idea though
20x of a few hundred a second is still only a few thousand a second.
In China 10 years ago, I've heard of stories that when someone got DDoSed and ransomed, they could pay to stop the attack (only relatively small amount of money). When they got DDoSed and ransomed again by another attacker, they simply told the previous attacker that they have already paid and the attack stopped.

Seems that they had some kind of alliance.
The subject of the photo, Lena Forsén, has explicitly called for it to be retired. No need to get all up in arms about what's "offensive"
https://en.m.wikipedia.org/wiki/Earth_Overshoot_Day

Despite some flaws with the above it is not crazy to believe we have finite resources. Your numbers are sadly orders of magnitude too low.
Sure. Edge cases will be infinite.
And time zone as well it seems
Absolutely not. Extecatly this recipe brought us this desaster.

The backdoor was in the released tar only, the sources were fine, because such a malicious m4 would have been detected. The compressed test bin containing the backdoor was in git, but such unobvious things do get attention.
As usual this is all about England rather than Britain as a whole. As ever none of the other countries get a mention. Apart from that it's a good overview of what's happened. But I find it interesting why social media isn't mentioned, because it played an important roll in polarising Brexit issues.
It’s early for me, but I missed the part where the UX designer actually talks to the people who use the app. That’s what killed it, not white space.
I'm not sure what it is on my machine(s), but I've found Pinta to be very unstable. It'll crash to desktop without warning in the middle of random operations. If it would just work reliably it's the paint app I want to use.
I take the opposite perspective: I'm so glad I got the opportunity to see all these amazing things be conjured out of thin air in front of my eyes. I feel sorry for the younger people who missed it, and only get to view the end result we have today. (Of course, they will go on to see other fantastic things I will miss, but that's hopefully far into the future so I'm less concerned about that.)

(On the contrary, I feel sad when things I missed are brought up. There's a lot that happened technologically in the late '60s and through the '70s that I can only read about in history books.)
Pinta is a fork of an older version of Paint.NET and (as far as I know) doesn't aim to be a clone.
Wanting to stay on RDS is a reason doesn't survive the sort of extra scrutiny that I said should be applied in situations where you're doing a lot of work towards an internal goal. It also says in the article that they thought it was too risky to migrate (but somehow building their own sharding solution is going to be less risky for some reason).

I could of course be wrong but it really just feels to me like the reasons given in the article are attempts to justify a decision that was actually made because of "not invented here" syndrome.
If you’re replacing nanosecond function calls with microservices, you’re doing it wrong. It’s a specious argument.

In the domains in which I’ve worked, most services receive calls over the network, and go on to make database calls that also go over the network. So whether you do the routing inside or outside a monolith makes almost no difference to latency. And what’s more, with a front end like GraphQL, you can parallelise the work which reduces latency further.

Microservices have a lot of benefits relative to monoliths, but they aren’t a panacea any more than monoliths are. They’re a useful architecture for certain workloads and a poor fit for certain others.

But in my experience it’s quite a lot more difficult to maintain discipline over the long term with monolithic architectures, and that’s why I tend to prefer microservices attached to messaging architectures like NATS. YMMV, and that’s fine.
Don't contort this narrative into a "culture overlords" conspiracy. The original model, Lena Forsén, has asked that the image be retired.
CVE-2008-0166

It was really bad.

https://github.com/g0tmi1k/debian-ssh
Are you suggesting intent is impossible to determine?
What about water for ZND or CBSOM?
I mostly agree, but:

> It's a shame rules have to be made to force behavior.

„Have to“ is doing a lot of heavy lifting in the sentence. Is this rule really necessary (because Lena’s gaze is just to enticing and leading the whole field astray)? Or is it just a method for moral crusaders to declare victory and their morals as supreme?
Altman and OAI – and their investors, more importantly – have already proven over decades and decades that they're in it for the money and at any cost to people including their own paying customers.

This generation is making the same can-kicking mistakes as their parents and nobody wants to admit it.
You’ve contributed to more than one of my songs and poems! Thanks!
How did the BBC present the tables of statistics in Chapter 1? They were something I had not been expecting to encounter in a work of art criticism!
Big cosign on this. Paint.net is about as good as it gets in the freeware closed source world.

The other one I love is MusicBee, which is a fantastic music library organizer and player.

I always try to pick open source options when they're available, but these two apps are so great it's hard to find a replacement.
Never trust Devin. Should have been clear from the first Debian-specific "improvement", which brought us the first ssh mess. systemd notifications are much easier to get than linking to it, and thus enabling such a backdoor. Amateurs shouldnt mess with critical security infra, esp. Debian's
How to (consistently) get 4.8* App Ratings
At what distance? If it's only like 10 feet than that's practically useful to nobody.
As a wise man once said: "drunk driving may kill a lot of people, but it also helps a lot of people get to work on time, so, it;s impossible to say if its bad or not"
I would say today there is no real need for autoconf anymore in C / C++ and the build process could be fairly easy.
Dishonesty and willingness to piggyback an already established industry/market.
Building from git, or the github automatic tarball would have. The larger issue here is authenticating tarballs against the source.
One thing missing here.

I develop cool thing X. Now, 100 minor things depend upon it.

Suddenly, Facebook (or anyone of that size!) starts using it, and decides to vet the maintainer/author.

Who says anyone has to cooperate? It's his software. He wrote it. Don't like it?

Well tough!

Now obviously Facebook could author a replacement. It could fork and maintain.

But the very nerve that Facebook(or anyone!) would insist upon a security audit of the anonymous author would be very, very strange.

Next up, I lend a neighbour my lawn mower, after he comes begging to borrow it. Oh but wait! My neighbour now wants me to sign a libabilty form, and also undergo a security check, all so he can borrow my lawnmower!

The hell?!?!

Hoping this illustrates my point. The project author owes nothing to anyone.

And it gets more wacky, if there are 100 companies demanding audits. What? Demand?!

This is where distros are the strong point. They aren't perfect, but they catch a lot of stuff on their own. And maintainers of different distros often backchannel, support each other in this.

In terms of some government org "vetting" people? Way to take the last vestiges of free software, and hacking, and turn it into a gatekeeping, bureaucratic nightmare. I guess one will need credentials, government id, a 10 year security check, to be fingerprinted, and so on? Security clearances work like that, and that's how you vet someone.
I don't need any strict settings for autoplay. I don't need autoplay.

Maybe there could be like a 2Mb cap on each page load that you'd manually had to extend the quota on. Most sites that need more are accidental visits anyway. That should work even if the site is user hostile.
I don't recall exactly when but i tried this same app at least a year or two ago. I was super excited but results it gave was kinda underwhelming. But again this was a while back. Hopefully it improved quite a bit because i really like this idea.
Completely agree; the issue I see with people who try putting logic in the DB ultimately to reject it is they try and bring their procedural programming paradigms (e.g. “for” loops and “if” statements) into the DB and that’s incredibly inefficient, requiring row-by-row looped fetches and ultimately causing their systems to grind to a halt and them to blame the concept of putting logic in the DB. If instead they were to embrace the declarative nature of the database and used efficient patterns such as statement triggers rather than row triggers, common table expressions (CTEs) rather than row-by-row looped processing, set-returning functions and joins rather than row-by-row function calls, etc then they would find that their code is both more expressive and often thousands of times more performant. As you say, embracing this model means less data transferred between cluster and client which can result in reduced load across the entire system without increasing complexity or having to worry about cache invalidation issues. And time spent learning databases is knowledge that will still be useful in a decade or two, it’s well worth investing into.
Please read this email [0] from the original author of xz. Try take his perspective in his described situation.

I also recommend this summary [1].

[0] https://www.mail-archive.com/xz-devel@tukaani.org/msg00567.h...
[1] https://boehs.org/node/everything-i-know-about-the-xz-backdo...
On your second point, the book Camera Work contains lots of really good photography from the late 1800s and very early 1900s, before they had even really figured out what photography is.

Looking at how beautiful pictures they were able to make with potatoes helped me stop worrying so much about gear and technical perfection. (I mean, art is subjective, but this I would judge to be beautiful and yet I can almost count the pixe^wsilver grains: https://kurtgippert.cdn.bibliopolis.com/pictures/018668_4.jp...)

(Playing really good old video games has the same effect for me except in that area.)
> When the product officially rolls out there will be a “no-go voice list” that detects and prevents AI-generated speakers that are too similar to prominent figures.

Should they then let anyone register their "voice id" to prevent others frok generating similar voices?

What if your voice happens to resemble the voice of a "prominent figure?"
Any reason why they shouldn't?
First polarized image of black hole at the center of our galaxy released
SS (L)imperator ocean liner
Powell said inflation stayed high, so prices will keep going up, company earnings / revenues and stock prices too he added ‘The economy is performing well’ in the news conference after the FOMC announcement.

Meanwhile Pelosi is buying all Al stocks she can think of...

If anything happens FED will cut rates & further stimulus the economy to reach new heights through monetary policy.

If not, he will keep triggering expectations to insure companies debt to equity ratio stays low.

He said he expects US inflation to keep cooling in coming months, expectations that already turned into SP500 all time high, again...

Plus 2024 is election year, this is only the beginning of a strong market rally, this year will stay in history.
It is a joy but makes it far too easy to pull in dependencies. And then Build.rs also runs. From a supply chain security perspective, Rust scares me.
Brilliant Pebbles (2001)
The biggest issue with the Figma article was they did not discuss partitioning the tables before they sharded them.
It’s a very cheap investment given the blast radius
Also: https://en.wikipedia.org/wiki/Brilliant_Pebbles
It's related to excessive coupling between modules and low coherence.

There is a way for programs to implement the systemd readiness notification protocol without using libsystemd, and thus without pulling in liblzma, which is coupled to libsystemd even though the readiness notification protocol does not require any form of compression. libsystemd provides a wide range of things which have only weak relationships to each other.

There are in fact two ways, as two people independently wrote their own client code for the systemd readiness notification protocol, which really does not require the whole of libsystemd and its dependencies to achieve. (It might be more than 2 people nowadays.)

* https://jdebp.uk/FGA/unix-daemon-readiness-protocol-problems...
And before that Forsén was a long time fine with it, but this didn’t stop the push to ban the image.
TablePlus supports quite a few databases. It adds up.
Collin worked on XZ and its predecessor ~15 years. It seems that he did that for free, at least in recent times. Anyone will lose motivation to work for free over this period of time.

At the same time, XZ became a cornerstone of major Linxus distributions, being systemd dependency and loaded, in particular, as part of sshd. What could go wrong?

In hindsight, the commercial idea of Red Hat, utilizing the free work of thousands of developers working "just for fun", turned out to be not so brilliant.
This whole thread is incomprehensible to me.

I guess no one knows how to harden an OS anymore so we just put everything in a container someone else made and hope for the best.
I strongly disagree. If you scratch the surface you find ”misoeater” and some russian sounding user names, and even a danish name. These are all fake profiles and gives us no information about the bad actor.

Spreading doubt is taught in bad actor-academy.
These changes were not backported to RHEL.
SS7 is a global issue, and so is social engineering to get a number transferred or SIM card transferred.

https://hitcon.org/2015/CMT/download/day1-d-r0.pdf
Unfortunately github appears to be actively breaking the ability to use git-bug on repositories with large numbers of pull requests (like nixpkgs):

https://github.com/MichaelMure/git-bug/issues/749#issuecomme...

They really don't want you to leave their walled garden.
Thanks for the mention. For Postgres, the easiest way to use PRQL is the plprql extension:

Link: https://github.com/kaspermarstal/plprql

Previous discussion: https://news.ycombinator.com/item?id=39428609
Not even for the browser?

What's your use case and what do you currently use?
Maybe they should stop letting authoritarian fascists post editorials.
I'm fully supportive to sandbox build.rs for that reason, but the same concern applies to pretty much everything in your computer so I'm not worried as much. In the other words, that risk is currently constant with respect to the choice of language.
Still better than TwoMinuteToiletPapers and other AI-bamboozled channels hyping over proprietary OpenAI crap (text/photo/video), what a time to be alive!
It's insane that this protection exists for "prominent figures" but nobody else. The same damage that can be done to prominent figures can be done to regular people, they acknowledge the damage can be done, and yet they're still rolling this out? The more OpenAI does the more it's clear they don't give a single damn about the consequences of their technology.
Since I didn't see it mentioned, my multiplatform (Java based) alternative to Paint.net is Pixelitor, https://pixelitor.sourceforge.io/
Something in between MS Paint - Paint.net I think.

I also use XPaint; it's quite capable but the interface is very different, too much deviated from usual GUI apps.
Descript acquired Lyrebird years ago and already have a product that can synthesize your voice.

They require training data longer than 15 seconds, which could lead the out out to resemble more the actual voice.

I've seen weird behaviors where the AI voice forces a British accent to pronounce certain words which I don't have.

Descript also uses voice synthesis to regenerate edited portions of conversations with a noticeable cut to smoothen the transition, which is pretty useful.
What do you propose? What would constitute a meaningful verification of identity that wouldn't create a near insurmountable hurdle for newcomers or those unable to travel?
I would love to hear a valid argument against it. Why microservices as opposed to say modules or libraries.
It's always Debian, like last time when they removed RNG randomness from ssh because of a warning.
It is also many orders of magnitude easier to fill large spaces with photosynthesizing devices which will convert CO2 from the atmosphere into usable material. Including foody building materials, fuels.
Paint.NET is by far my most missed Windows app on linux. GIMP is a mess of UI and Pinta just crashes constantly and is lacking in features.
You might enjoy https://www.cidrdb.org/cidr2024/papers/p48-neumann.pdf and https://github.com/viktorleis/saneqlcpp
https://www.gnu.org/software/autoconf-archive/