skysight-inc/HackerNews huggingface dataset:
Bloomberg article is better, but note they also ran that I said was spy for the British government when I worked in counter extremism work including writing in this topic for Reuters, Wall Street Journal and others.

These are details we gave them and they chose not to run.

In addition they ran reporting that we raised less than $25 million of additional funding when we raised well over that when we said that was false based on sources again.

We had to take it legal and right up to lead editor.
IrfanView configured to open with space bar in WindowsCommander (as TotalCommander was called at the time) for a quick view. Name a more iconic duo.
I guess to me it suggested even more eyes would be even better.
They made the same mistake we did at a former company — put a link to our webapp’s login page (app.foo.com) on the marketing site (www.foo.com) homepage.

It wasn’t until our first marketing web site outage that we realised that our $40/mo hosting plan was not merely hosting a “marketing site” but rather critical infrastructure. That was a load-bearing $40 hosting plan. Our app wasn’t down but the users thought it was.

I learned then that users follow the trails you make for them without realising there are others, and if you take one away then a segment of your user base be completely lost.
Doesn't matter. This is a supply chain attack, not a vulnerability arising from a bug. All sandboxing the certificate parsing code would have done is make the author of the backdoor do a little bit more work to hijack the necessarily un-sandboxed supervisor process.

Applying the usual exploit mitigations to supply chain attacks won't do much good.

What will? Kill distribution tarballs. Make every binary bit for bit reproducible from a known git hash. Minimize dependencies. Run whole programs with minimal privileges.

Oh, and finally support SHA2 in git to forever forestall some kind of preimage attack against a git commit hash.
SELinux context is passed down to child processes. If sshd is running as confined root (system_u:system_r:sshd_t or similar), then the bash spawned by RCE will be too. Even if sshd is allowed to masquerade as an unconfined non-root user, that user will (regardless of SELinux) be unable to read or write /dev/kmem, ignore standard file permissions, etc.
This comment is baffling. Just so you know, the IrfanView license requires commercial users to pay for a license, just like XnView does. Apparently that's... bad?
$99 once is a little different from $1k/month.
Note that while “Eastern Europe” has firm connotations with countries of which some are known for having corrupt autocracies, booming shady businesses, and organized crime and cybercrime gangs in varying proportions, the time zone mentioned also covers Finland, from which the other author is supposed to be.
They're trying; it's the subject of the second paper referenced at the end of the link above (direct link: <https://iopscience.iop.org/article/10.3847/2041-8213/ad2df1>, open access). It's a bit complicated but (for our galaxy's central SMBH, Sgr A), from simulations they have a confidence interval spanning a few tens of Gauss at significant radial distance to a few hundred Gauss near the event horizon, or an average somewhere below 30 Gauss. Early measurements of M87 (<https://iopscience.iop.org/article/10.3847/2041-8213/abe4de>) arrived at somewhere between one and thirty Gauss (on average) for that black hole.

By comparison, Earth's magnetic field is about 0.5 Gauss at the surface. So Sgr A's averaged magnetic field is strong compared to that. However...

The Earth's magnetic field strength increases with depth below the surface, reaching about 25 Gauss at the core, which is a lot less than near the horizon of Sgr A.

But sunspots are on the order of a thousand Gauss.

The strongest magnetic fields human technology has been able to generate is on the order of tens of millions of Gauss.

A magnetar's field strength is at least tens of billions of Gauss.

Our black hole has not been feeding recently (as in, for the past many thousands to millions of years dating from the view we have of it here and now), so doesn't have much matter around it to drive the field strength higher. M87* is not feeding much either. The best working model for magnetars describes an early non-equilibrum state for the magnetar in which at intermediate depth a complicated nuclear fluid acts as a proton-dominated superconductor. Flows within that fluid act as a dynamo (well, really a magnetohydrodynamic (MHD) generator) for the magnetic field. A significant accretion structure around a black hole can also act as as an MHD generator. Weakly feeding black holes lack such a structure.
Even so, is it really a big deal? There is more - and more varied and complex - music now, than there has ever been at any point in history. And you can find and access almost all of it instantly! Who cares or even knows what's in the charts these days? I can be a huge kids-these-days curmudgeon about music, and the recommendation algorithms aren't even that good, but I have found more music in the last five years that I truly love than I did in the entirety of teens.
Yeah, that's been working so well for forty years.
Makes sense. Add several with different resonance frequencies. This would also make the device degrade more gracefully if one of them dies.
Have you ever tried to manually build something from a release tarball by starting with ./configure? If so, have you observed how many times the compiler is invoked in this configure phase before you even run make?
I can’t go past the front page on mobile.
To be clear: we never raised less than $25m of additional funding.

Here are some examples of the work that I actually did in public that they chose to run as I said I was a spy

https://www.wsj.com/articles/emad-mostaque-the-spreading-men...

Here is me predicting ISIS as they would later be known would likely topple Western Iraq the following summer in December of 2013, top of business insiders chart of the year (which I think is very interesting)

https://www.businessinsider.com/most-important-charts-2013-1...
Now can you make one for jobs being replaced by H1B. Would love to see a detailed analysis about that.
Arguably, macOS is a BSD variant. Much of the userspace UNIX utilities and a lot of the networking stack were forked from FreeBSD. Although it's not the nicest showing, because Apple doesn't pull updates very frequently; a two decade old TCP stack has a lot of issues, Apple added MPTCP and nice PMTUD, but doesn't have SYN cookies, so I wouldn't run a public server with it.

Maybe you can find a BSD shell account somewhere? But otherwise, yeah, you need to run a BSD to experience it. How woulr you experience Linux without a Linux machine? There's live cds and virtual machine images and what nots for BSDs too.

I can't say if its worth your time or not. Not a lot of companies run production on FreeBSD anymore, unfortunately. Yahoo was midway through switching when I left, WhatsApp was almost done when I left. I'm happier running FreeBSD on my personal equipment than I was with Debian, but that makes it worthwhile for me, not you. Switching OSes is a long process and living in multiple OSes at the same time isn't easy. I use Linux for work, so I have to go back and forth between ifconfig on my home boxes and production Linux, but ip addr on my dev box. And sometimes netstat and sometimes ss, etc. It'd be nicer if everything was consistent and didn't change for what seems like the sake of change, but it is what it is.
The thing to do when you feel like a commenter is "beyond reason" is to flag the comment. Writing a long response to what you feel is an unreasonable or bad-faith comment is just feeding the toxicity. The abyss is commenting back into you, so to speak.

You can see the effect here: in trying to compose a reply to the parent comment, you managed to violate a variety of HN guidelines yourself.
> Compared to the overall effort invested, that's careless, badly planned or underfunded.

Not at all. It's a pattern that's very easy to spot while the eyes of the world are looking for it. When it was needed, it worked exactly as it needed to work. Had the backdoor not been discovered, no one would have noticed--just like no one did notice for the past couple of years.

Had anyone noticed at the time, it would have been very easy to just back off and try a different tactic a few months down the line. Once something worked, it would be quick to fade into forgotten history--unlikely to be noticed until, like now, the plan was already discovered.
A Counterfeit 8086 Processor (2020)
Re Shotwell. Great name for someone in rocketry.

Otoh: https://www.wknofm.org/commentary/2008-03-11/memphis-moment-...
Does Vintage Story not feel very polished? I was just about to find some time to try it.
A flashable secure enclave segment in the hardware stack is an option to patch around embedded bugs.

I haven’t worked in hardware design since the era of Nortel, and it was way different back then but the general physics are the same; if, else, while, and math operations in the hardware are not hard.

In fact your hardware is a general while loop; while has power, iterate around refreshing these memory states with these computed values, even in the absence of user input (which at the root is turning it on).

Programmers have grown accustomed to being necessary to running ignorant business machines but that’s never been a real requirement. Just a socialized one. And such memes are dying off.
Doesn't matter. A malicious sshd able to run commands arbitrary users can just run malicious commands as those users.

We'd need something more like a cryptographically attested setreuid() and execve() combination that would run only commands signed with the private key of the intended user. You'd want to use a shared clock or something to protect against replay attacks
CVE-2024-3094
That’s probably what GPT-4.5 will be. The bar is much higher for GPT-5.
Have to admit I've never understood why password auth is considered so much worse than using a cert - surely a decent password (long, random, etc) is for all practical purposes unguessable, and so you're either using a private RSA key that no-one can guess, or a password that no-one can guess, and then what's the difference? With the added inconvenience of having to pass around a certificate if you want to login to the same account from from multiple sources.
I’m not cherry picking. It’s just weird to see yet-another-editor in 2024, with developers having to reinvent everything from scratch.

I mean, half the comments here are disappointed that plugins will need to be coded in Steel/Scheme. That basically renders the entire world of editor plugins unusable. I just can’t wrap my head around that decision!
It's a nice analysis but he misses the fact that the Eastern Europe timezone doesn't match office hours, in particular it'd mean he worked around evenings primarily (see this graph https://files.catbox.moe/4itspl.png)

I had noticed UTC+0300 commits in the repository under his name but I believed they might have been simply committed by the main Finnish maintainer who is in the UTC+0300 timezone.

> But I would like to see analysis of timestamp of GitHub events (like PRs and comments timestamps) which are harder to fake.

I doubt the git commit timestamps are faked, since actually faking them is somewhat difficult to do consistently (you would time travel frequently). I don't think there is some kind of github API for this, however from what I've seen they seem to match up with the same work timespan you see in the commit timestamps.
They should have called it Deep Thought... what a missed opportunity :/

https://en.wikipedia.org/wiki/List_of_The_Hitchhiker%27s_Gui...
Company has money, revenue is better than peers with a path to profitability and one of the fastest ramps ever.

Tesla, Apple, NVIDIA all had these moments as well as innumerable other good companies.

Was tough to navigate through, very proud of team.
The US made a decision to prioritise corporations over their citizens

I get that it's easier to blame other countries for "free-riding", than to acknowledge that the US itself is to blame for the way it has decided to structure itself

If the population in the US want affordable healthcare, then they need to fight for it. That's what we did in Europe
The complexity cannot be over 10,000,000 if that simple program generated it. That is the precise definition of complexity.

I don’t understand what you mean by reducibility to random strings, randomness has precisely nothing to do with complexity, even if they do tend to go together.
Would also highly recommend! It's not quite exactly a practical handbook, and doesn't cover topics such as duvet cover changing, but it is considerably more relevant than most popular science/mathematics books. The very first chapter, for instance, covers the idea of explore/exploit choices, and does so in a way that is both general enough to be genuinely useful in everyday life (at least at a conceptual level) and mathematically rigorous enough not to throw you off should you want to read further.
AST diffs instead of textual diffs might have helped here (to spot the `.` making the code un-compilable).

Edit: oof, though the stray character in question is inside a perfectly legitimate C string, so to catch this, any such diffs would need to Matroyshka down and that seems unsolvable / intractable.
There's also git time machine to quickly rollback a buffer in place
A calendar alert is an automated alert, is it not?
Never had this happen, this is largely eliminated by using tools like black or other autoformatters.
I'm not sure that's on the Linux crowd: UEFI is what the hardware ships with, they don't really have much of a choice.
It seems like Lasse Collin is back on the scene and maybe pissed?
The back door is damage. The resulting sshd is like a door with a broken lock. This patch breaks the lock. Transmitting the patch caused intentional damage.
Yes. I 100% understand why GitHub (and now Microsoft, as well as every other platform) is incentivized to be evil. FWIW, I'd even pay for the CNAME support, as they are then a hosting company, but I also understand why they make more money in aggregate off of all of the locked-in users than they would from the random people who would pay for it to not be evil. I will say: my conclusion is that no one should ever be using GitHub.
Autoconf and CMake both compile small test programs to verify that the feature in question actually works. The test programs almost never actually do anything; the just refer to the feature of function that they rely on. If there is a compile or linker error then the feature isn’t available. In this case the compiler always outputs an error because the test program doesn’t have valid C syntax.

Of course in practice you shouldn’t be writing each test program by hand. Autoconf has macros that generate them; you would only need to supply an identifier or at most a single line of code and the rest would be created correctly. I’m sure CMake is similar in that regard, so the first red flag is that they wrote a whole test program.
Yes, this won't directly protect against an attacker whose goal is to create a botnet, mine some crypto on your dime, etc. However, it will protect against corruption of the O/S itself and, in tandem with other controls, can limit the abilities an attacker has, and ensure things like auditing are still enforced (which can be tied to monitoring, and also used for forensics).

Whether it's worth it or not depends on circumstances. In many cloud environments, nuking the VM instance and starting over is probably easier than fiddling with SELinux.
Still in https://ninite.com/ selection view
Like Delphi, FreePascal and Lazarus, though less often for those three than for IrfanView, and those three get a good number of sneers by modern ignoramuses, each time. The joke is on them, due to the amount of late night and weekend work (unpaid, often) that many of them have to pull, and tamely accept and try to justify, to save their egos and paychecks.

"The emperor has no clothes" kind of thing
...

And nowadays, layoffs, too ...
I suspect I could have used this exact attack against 10,000 random SSH servers spread all over the world, and not be detected.

Most people don't log TCP connections, and those that do don't go through their logs looking for odd certificates in ssh connections.

And no common logging at the ssh/pam level would have picked this up.

Your only chance is some sysadmin who has put 'tripwires' on certain syscalls like system(), fork() or mmap() looking for anything unusual.

Even then, they might detect the attack, yet have no chance at actually finding how the malicious code loaded itself.
Of course they are. Everything is.
really surprised myself. Seems like AI could design some very credible websites and marketing material... but maybe it takes more to integrate all those images together into a cohesive look?
I… am not following this. Novo Nordisk for example is a Danish company.

I haven’t seen anyone say American pharma companies in particular need to make a ton of money.

The American-specific topic is that American consumers pay a ton more for drugs. That can be chalked up to lack of single-payer making American consumers incredibly easy to bully/negotiate against + all the rent-seekers who sit at various points along the care delivery system.
Anecdotally, yes, LLMs are more effective at decreasing escalations to humans.
This is quite misguided as you seem to think the alphabet for Shannon entropy or Kolmogorov complexity is in any way what we think of as an alphabet.

Did you know the best compression methods out all have a variable length (measured in bits) alphabet? eg. Dynamic Markov Coding will start with just '0' and '1' and then predict the next bit but as it see's more symbols it will extend this to single characters (so see 'a' or 'b' and predict the next bit). They'll then continue as they learn more of the file and their alphabet will essentially include common pairwise letters, then words and entire common phrases.

This is actually a commonly missed aspect of Shannon entropy. A file of 0111101110111 repeated will give you a different result if you consider a 1 bit alphabet of 25% '0' and 75% '1' than a 4 bit alphabet of 100% '0111'. No one in the real world is using the character frequencies of english characters as a measure of Shannon entropy or Kolmogorov complexity. No algorithm expects that. They all work at the binary level and they will try to adjust the symbol lengths of the alphabet to common sequences to achieve the best result.

This is in fact the reason Kolmogorov complexity is used rather than Shannon entropy. Shannon entropy doesn't tell you how to define an optimal alphabet. That part is actually undefinable. It just tells you what to do if you have that already. Kolmogorov complexity says more completely 'find the optimal alphabet and the symbol probabilities and make a minimal sequence from that'.

Different human languages don't figure into this at all and are completely irrelevant.
I don't know. It is a good album, but I don't know that any of the songs there are 'hits' in the sense that they would have wide popular appeal and be played on high rotation on radio stations. It just doesn't feel like that kind of album, with those kinds of songs.

I love Suzanne Vega's music and all her albums, but I do find Days of Open Hand a kind of very bleak record, and the 'Book of Dreams' single not particularly representative of the album. I kind of wonder if Vega was a little unhappy around tht time, but I have no idea.

And music tastes of the public change over time. The Top 40 every decade since 1970 sound very different. It's very generational, it's also very reactionary against previous generations.
It’s by “design”, in the sense that C and C++ provide no better way to really know for sure that the functions you want to call really exist. In more modern languages we rely on metadata and semver, but none of that exists for C and C++.
And for that investment society now has a new drug anyone can make at cost from t+20 year till forever. I'm not seeing how society is getting screwed here in the big picture.
Short answer: anything it wants.

IME has privileged access to the MMU(s), all system memory, and even out-of-band access to the network adapter such the the OS cannot inspect network traffic originating with or destined for the IME.
Your tone is unwarranted. Also, an empty appeal to modernity, lacking any specifics whatsoever, is about as lazy as arguments get.
The method in the paper seems different than what was reported. They used a last.fm dataset of two billion listens across 50 million songs. They enriched the data and restricted the study to 1990-2020 to create a balanced dataset of the 350k songs for training their stat tools. Then they analyzed 2,400 songs per genre with that, 12,000 total. I didn't see "top 40" mentioned in the paper.
Or targeted not really at doing anything but at researching the nature of supply chain vulnerabilities themselves.
Out of curiosity have you tried ocrs by Robert Knight? https://github.com/robertknight/ocrs
I was lead architect of CAIAC to organise Covid knowledge launched at Stanford before this

https://hai.stanford.edu/watch-caiac

The big companies here and more promised me tech to build the system and didn't deliver which is why I did Stability to make sure there were open alternatives.

Still achieving the output we did based on completely diverse global team form mostly untraditional backgrounds outside SF & the resources we had is a positive not negative story.

The first 20 employees I hired were graduates from the job centre in Ilford and we built this above a chicken shop.

Talk about that here https://x.com/PeterDiamandis/status/1773863016775213545?s=20
It's a fantasy NES expansion like how the Pico 8 is a fantasy console. I think it's really cool, especially since the game will be coming out on a cartridge that's playable on a real NES
Does that run locally without the need to share information?
Asset values should be compared against asset values.

Novo Nordisk makes 17% of Danish stock index. Vestas and DSV are both 10%

(Foreign investors' ownership of listed Danish shares is over 50%, so I assume the situation is similar to NN when you remove the foundation owned stocks)
No. You are still bitter about systemd and are trying to assert blame which does not reasonably exist.
Reminded me of "Growing Living Rat Neurons To Play... DOOM?"

https://www.youtube.com/watch?v=bEXefdbQDjw
As I understand it Jia was contributing things like tests, not making changes that involve “security”. They just turned the commit, and eventual ability to make releases on the xz GitHub after “earning” more trust (+ access to GitHub pages hosted under tukaani domain), into something they could use to insert a backdoor.

No questions. Anyone can become a victim to social engineering — I believe the short answer to your question about all the downvotes is that a lot of people recognize how they could have fallen for something similar, and empathize that Lasse is likely now going through a rather difficult time.