skysight-inc/HackerNews huggingface dataset:
Contributions from anons can and in most cases will be verified by maintainers. The actual problem here is appointing them as maintainers.

EDIT: To be clear, this problem is not directed to the original xz maintainer, but more about how to prevent or reduce such appointments in the first place.
In systems performance I would advise to never think of any workload as unidimensional (ie: Any file system optimization can either improve IO latency or be useless)

Issuing individual truncates of 1B files can be just as much of a CPU problem then an IO one for example.
Was this article hallucinated by ChatGPT? Many of the features described look odd and it doesn't cite sources for them.

For example, the "stream gatherer in action" example seems to just be using collectors, which is an older feature[0].

The scoped value example (which "could revolutionize [...] enhancing the efficiency") seems to use some API I can't find in the JEP and which has zero hits on Google aside from this article. It also has the text "java" and "Copy code" at the start of the code snippet, as if it was copied from somewhere and accidentally copied the UI elements.

The string template example uses a completely different syntax from what I've seen proposed, without giving any details about this changing.

[0] https://www.baeldung.com/java-groupingby-collector
I guess being offended or not by this is entirely subjective, as we can see from our wildly different perspectives on the matter. I guess that’s why we should never base a ban on it, right?
You have a point there. For the record, Fedora was affected too.
As a proof of concept, this looks very cool. Suggestion: add a short example to the README.

I had one experience with Prolog in the 1980s that blew my mind. I had an IR&D project to build a complete prototype of an air/land battle simulator (yes, I was a defense contractor back then) in Common Lisp given 6 weeks of coverage to write it and demo it. After a month I was satisfied with the functionality and after demoing it I asked permission to rewrite it in ExperProlog on the Mac (I had done the Common Lisp version in my Xerox 1108 Lisp Machine). In ten days time it was done, and also had nice graphics and UI extensions that the Common Lisp version did not have. Anyway, except for few small open source things, that was the only large project I ever did in Prolog.
Ignorance of the law isn’t an excuse, right?

If you read a post on Reddit from someone claiming to be a lawyer and you break the law, who’s in trouble?
Are these undocumented syscalls somewhere documented? ;)
You should see what farmers have been doing with carbon dioxide for thousands of years.
If your app works with data in the DB and nothing else, sure.

What if you have complex integrations of external services, need to serialize and parse huge JSON or XML, do processing on the data and send it back and forth, accept and trigger webhooks...? That's the workload I'm imagining would be easier to scale on a separate app server.
If it’s segmented and opt in then there’s no issue here.
In my circles, this is the go-to for release automation / changelogs: https://github.com/changesets/changesets
It’s hard to tell if you can improve technology until it’s good enough (jet engines) or if it’s a futile dead end.

Kelly Johnson of Skunkworks had a keen mind for differentiating between them.
Would you ask for it to be formally banned by a scientific umbrella organisation?
>Construction work is required to retarget beam.

If you mount two of them like a gyroscope, inside a spherical opening, the planes could overlap into a target-able beam.
The equivalents in memory safe languages raise more eyebrows. Segfault developing on a shared C codebase and it's a day ending with y. Segfault in a language that's meant to not let that happen? Or conversely if a patch turns up that's explicitly doing lots of unsafe things? That gets more scrutiny.
Actually quite a lot. You can check the glassdoor and then search the companies market cap over the years. One company I research recently, Philips seem to have this problem 15 years ago. Compounding effected today, it is just a very small insignificant company. Meanwhile it gave birth to titans like ASML.
Acquisitions
The configure script is not a compilation artifact.

The more steps you add to get final product the more errors are possible. It's much easier for you as the project developer to generate the script so you should do it.

If it's easier for you to generate the binary, you should do it as well (reproducible binaries of course). That's why Windows binaries are often shipped. With Linux binaries this is much harder (even though there are solutions now). With OSX it depends if you have the newest CPU architecture or not.
I mean pornhub needs some competition.
ho it's billion, my bad ahah
I felt that way about what CS did to the Quake 2 community.
This is the opposite of what lego is good for.

Why scan a pile of Lego and suggest projects, when you can also have a robot build those projects for you?

In fact, why not 3D print a finished piece designed by AI?

You still get the fun of cleaning up mold lines for the AI, unless they build a robot for that.
Maps, Chrome, Golang, Android, Photos
That's an interesting idea as well, could definitely see that working in some use cases.
In some ways, this just feels like a reversion to the mean for humanity. “Don’t believe everything you read” is a maxim as old as print, and it’s good advice. If people ultimately learn that videos and recordings can’t be trusted, is that a huge loss? I’m not sure.

Of course, the road from here to there may be bumpy...
They could always archive it. Theoretically (and I mean theoretically only), there's another reason for Microsoft to prevent access to repo: if a nation state was involved, and there've been backdoor conversations to obfuscate the trail.
Where Do EU Horizon H2020 Fundings Go?
I met with my high-school friend and band buddy Thomas Bartchi in 2004 at a café in Copenhagen.

We were discussing this audio job he was applying to in Germany for a gaming company. He had an upcoming interview with them and we were brainstorming what new ways you could utilize audio engineering to write more interactive soundtracks.

The normal way was simply to change soundtrack when you went from normal mode to high action. But we started discussing a more interactive approach I had been playing around with in the CD-ROM lingo days and because Thomas was an excellent composer and understood audio engineering at a very deep level we came up with the idea of constructing a sound track in layers so that there would be some audio layer that were always there, but others would then be added or removed to provide a almost a gradient audio intensity experience.

The challenge was obviously to make it feel very different gradually even though you were mostly using many of the same elements and just layering them.

He went there and while there were other great candidates they gave him the job because of his way of thinking about music in games and the rest is history.

His successor for the next game was none other than Hans Zimmer.

He later went on to do music for Hitman.

Here is the FarCry soundtrack if you want to be taken back in time:
https://soundcloud.com/j-wilhelm-139558882/far-cry-2004-main...
Unfortunately we can't put the cat back in the box, so even if you don't have that attitude, what are you to do? join the Amish? new tech isn't always an improvement, but we can't uninvent things, just like we can't unsee things.
My guess is this: Mazda believes its battery-only range is enough for most driving situations. If they're right, the rotary engine's more limited lifespan would be a moot point since it will still last the vehicle's entire lifetime. One can only hope.

The maintenance thing is concerning, though. Nobody knows how to work on these things. As an RX-7 or RX-8 owner, you're either doing most of your engine work by yourself, or you're driving very long distances to go to a specialty shop. We can pray that it's reliable enough for this to not be a problem, but if these engines start failing, it's going to be a huge mess.

Side note - the geometry of a Wankel rotary engine makes a diesel version impossible - you can't get enough compression. Diesel rotaries do exist though. An American company called Liquid Piston is making them for the Army. The intent is to use them in diesel generators, since the resulting generator is much smaller and lighter than more traditional diesel generators.
If the compiler is some customized or hard to build version then yes, they should be included.

The more steps you add to get to the final product the more likely it is to run into problems.
The phisher can just pass on whatever you sign, and capture the token the server sends back.

Sure, you can probably come up with some non-HTTPS scheme that can address this, but I don't see any site actually doing this, so you're back to the unrealistic scenario.
Where are you getting this from? JiaT75 reviewed a pull request by xry111 including said optimization (which hadn't yet been merged), that's all.
Nestable transactions = “real transactions” to me, I guess.

I almost don’t see the point in non-nestable transactions
https://twitter.com/LEGO_Group/status/842115345280294912?lan...
'I can't think of one therefore there isn't one'. Maybe, maybe not.
I’m guessing nobody else brought it up because the original article already mentioned this fact.
Sure, but what if I’m querying an official government chatbot about the law?

That’s more like asking a policeman on the street or a judge than an anonymous person on Reddit.
I have never used Facebook.

Zuck goes to great lengths to demonstrate why you shouldn't either.
Nah, it was 2MB.
!
(Which is what I remember)

https://news.ycombinator.com/item?id=19000696

Contemporaneous discussion:

https://techreport.com/forums/viewtopic.php?t=19510
Xz: Can you spot the single character that disabled Linux landlock?
She is still very proud about the photo. So if she changes her mind again, your principled opinion is to unban and use the image again?
Answer: https://git.tukaani.org/?p=xz.git;a=commitdiff;h=f9cf4c05edd...

Description of Linux's Landlock access control system if you are not familiar with it: https://docs.kernel.org/userspace-api/landlock.html

xz official (maybe...) incident response page: https://tukaani.org/xz-backdoor/
The perpetrator is clearly a highly skilled dev, it doesn’t seem farfetched that they could become acquainted with a ‘foreign’ tech stack to sell a cover story
This is so cool! The way the search engine has been built up also seems very smart. I'm honestly surprised too at the same time, that this kind of idea hasn't been worked on before (couldn't find anything similar; I could be very wrong)

I'm not sure if this type of problem is even a considerable one, but how does the search engine handle reviews from subreddits which are focussed only on a particular brand, and may potentially form a bias around such products? Does the LLM's awareness of each review's context handle that?
That bromine is a necessary element was only discovered about a decade ago. It's apparently necessary to form weird sulfur-nitrogen double bonds in collagen IV.

https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4144415/
Any guesses what rate they'd rate for such ad spots? I'd assume the CPM would be low.
Don’t forget business people. Clone the voice of some executives and start calling people pretending to be them
Alienating art has been a staple of many past social revolutions, the “made up of steel” thing (like in this case) is just a secondary issue.

But I get this guy’s appeal and I also get why his audience wouldn’t want to see it that way, it is what is, nothing that the two of us can do about it other than trying to talk over an over-increasing socio-economic wall.
I think I went through all the stages of grief. Now at the stage of acceptance here’s what I hope: I hope justice is done. Whoever is doing this be they a misguided current black hat (hopefully, future white hat) hacker, or just someone or someones that want to see the world burn or something in between that we see justice. And then forgiveness and acceptance and all that can happen later.

Mitnick reformed after he was convicted (whether you think that was warranted or not). Here if these folks are Mitnick’s or bad actors etc let’s get all the facts on the table and figure this out.

What’s clear is that we all need to be ever vigilant: that seemingly innocent patch could be part of a more nefarious thing.

We’ve seen it before with that university sending patches to the kernel to “test” how well the core team was at security and how well that went over.

Anyways. Yeah. Glad you all allowed me to grow. And I learned that I have an emotional connection to open source for better or worse: so much of my life professional and otherwise is enabled by it and so threats to it I guess I take personally.
We shouldn’t rely on the Internet Archive when we don’t have to. It is a nonprofit that has faced significant legal challenges in recent years, and it has many other priorities. It’s a backup in case of disaster and a historical record, not a replacement. I love it and its value is immaculate, but it is asking too much of it to clean up every mess like this.

There’s also the print archives, which are not available online.
I think I remember seeing someone run Crysis in software on a 128core AMD Epyc and get a decent frame rate.
I see a big difference between one side searching for human written content and not finding it and on the other side just making up stuff. Maybe most people expect the AI to search and quote from existing human-authored content? At least in situations where laws and regulations are involved this should be the default.

The problem will only get worse and you can expect humans to copy those AI-authored answers into the web where AIs are likely to digest them as facts.
AND found a way to sound cool while doing that. (My fingers are itching to add some comment about the fact that she’s Swedish but I’m sure that has no correlation whatsoever with jumping in on meaningless postmodern cancel culture bandwagons)
I occasionally use that feature. But absolutely every single time is by mistake and it has negative effects on my mood. Still love Firefox though.
There seems to be a correlation between us and causation.
X is a pretty good name for the site because it already is full of NSFW content. I have very few followers and still get porn bots replying to several of my posts and comments. It's frankly pretty gross.

I predict that we're eventually going to discover that like Tumblr and Reddit, hosting porn was a key part of Twitter's business all along.
In 1983, the US Capitol was bombed.

The terrorists went on the run, but were known.

In 2021, the current attorney general of the US, Merrick Garland, signed off on not prosecuting them.

https://www.washingtontimes.com/news/2024/mar/29/democrats-e...
Republicans have started using "committed to free speech" as a euphemism for "doesn't censor hate speech or misinformation". The problem with that isn't that it's impossible to make an argument that "protecting free speech" should cover that, the problem is that they are hiding that controversial argument behind the less controversial argument to protect free speech.
Right, in order to fairly describe this man's artworks as any more dangerous than average based on their entire functional lifecycle we'd need to evaluate, for example, how many people were killed while producing the marble blocks used by sculptors such as Michaelangelo, or how many people died as a side effect of exposure to toxic compounds (e.g. cinnabar (red), cobalt (blue), lead (white)) while producing pigments for painters such as Rembrandt.
Because I didn't know about it.

Although if I look at its documentation, it's already a somewhat complicate invocation with unclear effects (lots of commandline options). Git seems to not be able to do KISS.

git ls-files and tar is a simple thing everybody understands and can do without much issues.
Indeed - seeing the level of sophistication and long term thinking behind this attack, it seems everything about it was planned meticulously, including usernames, attack vectors, communication with the community, and when to commit the parts of the exploit. There's probably a full team of people behind it and attributing it to China because of the username may be too quick.
If everyone is running LTS, then discovery just runs to LTS.

the reason $currentDumpsterFire is identified is only because it's being used. Cannon fodder exists for a purpose.
Same here. I've paid for the quite expensive (relative to mobile apps market) one-off license only to discover it has a very high error ratio (sees blocks that aren't there) and extremely simple projects to build (in the range of 10-30 blocks total). I wouldn't recommend it to anyone barring the free use for simplest of builds.
Jonathan Blow predicted the style of backdoor used in xz attack [video]
Is that alllowed now still?
Hey you should turn this tale into a thriller - would definitely read it
There's a pretty big difference between athletes and school children and what fitness training and what long hours of math crunching do to your body and mind.
Except that it wasn't their architecture which allowed them to weather this storm: it's Cloudflare's. And the storm is a whopping 1.85 requests per second, all coming from Europe which means this isn't even a DDoS to begin with.
the challenge with hyperledger is that there you can run unlimited arbitrary executions of any computational time, but have to run all other nodes’ arbitrary executions of any computational time, so the whole network is DDOSing each other with these stupidly expensive computations all for the sake of saying “blockchain without crypto!”

as if the crypto didn't serve the specific purpose of putting a cost on computational transactions, creating limited block space, so that people wouldn't do expensive computations

it doesn’t solve any problem that blockchain set out to solve, its nice that you found a way to have a shared google spreadsheet with macros without having to debate over whose account made the doc or organization, but its not a technological improvement that presents a novel alternative to a fungible data writing credit that crypto is, the only improvement is catering to a gullible enterprise audience who simply asked for a no-coin version of blockchain so they could say they have a blockchain strategy, grifting to enterprise clients is fine until those users act like they solved a deficiency of speculation as if thats a problem at all

public blockchains and smart contracts have a solution for the problems you mentioned so far, those are the myriad of concerns I’m referring to. Public blockchains also provide benefits to transparency and security that make the SROs and securities regulator redundant in their current form. There is another more productive way they can improve the things deployed on blockchains and give confidence to investors, but that’s only going to come from the blockchain space’s own regulatory capture, ironically thanks to speculation creating new consolidation of power and interest.
This is often user error. Many bike lights have a daytime mode that is far too bright for night. But winning the arms race is so important...
Especially since they moved to texas
I’ve noticed this s lot cycling in NYC. One alternative that I like a lot: play music from a portable bluetooth speaker to make your presence obvious.
Given their track record, I honestly imagine they just don’t care. See what they did with Gambling Times to get an idea of how they treat a publication with a deep archive.
As far as I can tell, Rust _does_ support dynamic linking. You can both compile rust code to .so and link against existing shared objects. What are you talking about?

>The compiler supports various methods to link crates together both statically and dynamically. This section will explore the various methods to link crates together, and more information about native libraries can be found in the FFI section of the book.

https://doc.rust-lang.org/reference/linkage.html
That's ridiculous. Adding the dependency to libsystemd in no way created any vulnerability. Even the indirect dependency on liblzma didn't add any vulnerability. It took a separate malicious maintainer doing a later change to liblzma so that it ran code when the library was loaded to create the vulnerability.
Ah, you’re literally thinking in a higher dimension to me!
Link not pointing to an article
Oof yeah that’s a good point
It seems like everyone is doing it. Does anyone care? Should anyone care?
scammers have already used this technology to convince people that someone they know needs money for some reason
This is not the headline.
Honestly cryptographic signatures being more widespread does not seem a bad thing to me.

Obviously not everywhere: I don't need a reddit worldnews comment or a recipe for blueberry muffins signed.
There may be some suboptimal things about security of the XZ file format, I don't know.
I bet you there are less than optimal security choices in your most cherished piece of software as well.

This thread is about an exploit that does not rely on any potential security problems in the DESIGN of the xz FORMAT. Therefore your point, even if valid as a general one, is not really relevant to the exploit we're discussing.

Further, there's some proof needed that any potential suboptimal aspects of the security design of the xz FORMAT was designed such so that it could be exploited later or simply because no programmer is an expert on every aspect of security ever. I mean you could be the most security conscious programmer and your chain could still be compromised.

Security today is such a vast field and it takes so little to get you compromised that proclaiming anything 'secure design' these days is practically impossible.

I bet you an audit of lzip would find plenty of security issues, would those be intentional?
Somebody pointed out fairly early that the current stable release was released by the same account too, and I wondered how deep this hole would go.
The change is adding a NSFW tag. Seems like a way for people to find/avoid that content more easily depending on their taste.

Why is the whole article dooming about adult media on twitter? Is there a porn problem that in all my twitter use I've yet to stumble upon? Is it because other platforms have hard sent on TV-14?
I find younger generations fascinated when I explain how Gmail was "invite-only" in its early years. Some of my earliest archived emails are conversations with random forum friends who I provided with one of my six allotted invites.
There are more accidents in the US than in civilized countries. Per mile.
Just maybe your ideas weren’t fully thought out?
The International Linguistics Olympiad
I saw https://news.ycombinator.com/item?id=39866716 yesterday but subsequent comments actually linked to it and a quick trip to the internet archive says you’re right.
That's a complete pseudoscientific quack, sorry to be so blunt.

Even if it wasn't, it doesn't meaningfully invalidate anything I said.
Good question was asked by debian devs: what's the future for xz now?

I feel it is not really worth it to vet 2 years' worth of changes by a malicious actor, who had been actively trying to make any exploits add by them as hard to discover as possible, when good alternatives, like zstd, exist.
That is the actual headline. "Female Athletes Unhappy After Being Asked to ‘Lose Gracefully’ to Trans Competitors"
Yes, I guess it'll be pretty low, but low and a lot is better than nothing.

You know, the usual decline of a page.
The numbers given in my the article are 800k requests in five days for a static file, which is 1.85 requests per second and no database access. It's not even a DDoS by your own description here.