skysight-inc/HackerNews huggingface dataset:
I'd hardly call that a DDoS attack: from the description given, the extra 8TB-or-so of monthly traffic seems to fall under "annoyingly pointless abuse of services"...

As long as such abuse doesn't cause monetary or resource exhaustion concerns, it's quite OK to ignore it, but stories like "whelp, turns out that 80% of the capacity of our auto-scaling fleet is not doing anything useful" are depressingly common enough to at least keep an eye on things.

My annoyance with this kind of abuse revolves mostly around logging: a majority of logs just showing the same set of hosts displaying the same pointless behavior over and over again. Again, not a huge issue if your log storage is cheap and plentiful (as it should be), but having some kind of way to automatically classify certain traffic as abusive and suppress routine handling of that is definitely a good idea.

It's also a lot harder than it sounds! I can't count the number of times I've added classification logic to my inbound SMTP server that should pick up on outright, silly abuse (of which there is a lot when dealing with email), only to have it triggered by some borderline-valid scenario as well.

Spending way too much time on going down successive rabbit holes is a great way not to get any real work done -- a great reason to outsource, or, if that's too much work as well or just too expensive, indeed just ignore the abuse, annoying though it is...
At least 8TB. 4TB is UK only.
Use books and papers from the Library of Genesis - that gives you good context, even while the search engines collapse

End Google

Long live The Library!
Took me a while to realize tar format doesn't have any crc/checksum.

(usually compression format has it though)
I absolutely am! Doh!
Even better, a nuclear power plant
I think you're thinking of Europa and Titan, which are moons not planets.

The gas giants themselves are much harder to extract resources from than the moons, and ISRU from the moons (even our own) are beyond us for the moment even if they have more of both in total.

As we can already synthesise diamond from methane, I couldn't guess what we'll be doing by the time Titan looks like an interesting target for industrial expansion.
the motivation is probably "get foot in the door". the attacker also made a few documentation-only PRs in various repos, but having code PR will make him more creditable, and also would help to add more backdoors to libarchive in the future

and librachive is now part of Windows 10, being used as a universal archive decompression library in the Explorer
Literally the entire guiding principle for security architecture for the past decade or even more has been that "there is no such thing as an indestructible wall".
The water was wet in that game. Absurdly amazing graphics for the time.
Red scotch tape over door handle is much easier to apply or replace.
Something that is critical to life should not be connected to Internet.
Yeah Goroutines are great. Then add something like WebRTC to your project that realistically tops out at 10000 listeners, and people wonder why Twitter Spaces is so buggy...
I guess this is an ad, so I'll bite: Why is the mac download button featured so centrally, while there appear also to be downloads for other platforms, too? It's not like that's a usual default.
>namespaces (which have been a frequent source of vulnerabilities)...

Unprivileged user namespaces sure, but I don't think that applies to namespaces in general (which without unprivileged user namespaces can only be created by root, and LPE is the concern with unprivileged userns due to increased attack surface). systemd doesn't need unprivileged userns to run.
State actor or not, let's not ignore that the backdoor has been discovered thanks to the open nature of the projects involved that allowed digging into the code. Just another example like the infamous Borland InterBase backdoor in the early 2K that remained dormant for years and was discovered months after the source code has been released.
If the xz malware authors worked for any corp that produced closed source drivers or blobs that can't be properly audited, we would be fucked; I just hope this is not already happening, because the attack surface in all those devices and appliances out there running closed code is huge.
Sadly this is exactly one of the cases where open source is much more vulnerable to a state actor sponsored attack than proprietary software. (it is also easier to find such backdoors in OS software but that's BTW)

Why? Well, consider this, to "contribute" to a proprietary project you need to get hired by a company, go through their he. Also they have to be hiring in the right team etc. Your operative has to be in a different country, needs a CV that checks out, passports/ids are checked etc.

But to contribute to an OS project? You just need an email address. Your operative sends good contributions until they build trust, then they start introducing backdoors in the part of the code "no one, but them understands".

The cost of such attack is a lot lower for a state actor so we have to assume every single OS project that has a potential to get back doored had many attempts of doing so. (proprietary software too, but as mentioned, this is much more expensive)

So what is the solution? IDK, but enforcing certain "understandability" requirements can be a part of it.
Nah. I'm sure Microsoft got a call from the alphabet boys and nobody, not even internal employees are allowed to look at the logs right now.
Decisions at 37signals
There's an interesting read of the possible reasons different companies succeed with different aged founders here:

Research: The Average Age of a Successful Startup Founder Is 45
https://hbr.org/2018/07/research-the-average-age-of-a-succes...

discussed on HN: https://news.ycombinator.com/item?id=18212409
I remember being a kid and wanting to play Far Cry in high quality when it came out. I did not have the money to buy the best graphics card to play it smoothly on high settings. So, I could either play it in low quality with something like 60 FPS or in high quality with something like 15 FPS. Of course, 15 FPS is not enough to play the game properly, but to capture all the beautiful details, I just went with the highest settings and very slowly explored the beach, astounded by all the details. Good memories.
It’s not a cure-all. I mean, we’re talking about infosec - so nothing is. But that said, barely any programs need the ability to execute arbitrary binaries. I can’t remember the last time I used eval() in JavaScript.

I agree that it wouldn’t stop this library from injecting backdoors into decompressed executables. But I still think it would be a big help anyway. It would stop this attack from working.

At the big picture, we need to acknowledge that we can’t implicitly trust opensource libraries on the internet. They are written by strangers, and if you wouldn’t invite them into your home you shouldn’t give them permission to execute arbitrary code with user level permissions on your computer.

I don’t think there are any one size fits all answers here. And I can’t see a way to make your “tainted output” idea work. But even so, cutting down the trusted surface area from “leftpad can cryptolocker your computer” to “Leftpad could return bad output” sounds like it would move us in the right direction.
I saw that deno did this but cool to see node picked it up too. I wish there was an option to run turbofan at build to generate the instructions rather than shipping the entire engine, but i guess that would require static deps and no eval, which can’t really be statically checked with certainty
Was hoping for something more swole dog worthy when reading the headline. Even though I agree with much of the advice, being behind Cloudflare is definetly not nothing.

Depending on the distribution of the traffic they might have survived well on VPS's without Cloudflare anyways, doesn't seem that large. Would be interesting to see more detailed stats of rps and how much (if any) Cloudflare stopped before they got it.

Russian layer7 ddos'es that I know of targeting Swedish companies have been large enough that major providers run into capacity problems and fall over (including Verizon, Azure Frontdoor, Cloudflare, GCP's Load balancer). This strategy would absolutely not work against those volumes.
That's irrelevant to the file formats themselves, however. A simple file format doesn't automatically guarantee a simple implementation, especially for compression algorithms.
Radix economy is all about which base is the most efficient to represent a given number. It is simple to show that, for large numbers, this is equivalent to how efficient a base can represent itself, b/ln(b). Simple calculus shows this is minimized at e (Euler's number) or 3 if integer (closely followed by 2).

It sounds like you have something to add but you are already dictating the base by saying "bit". Literally from "binary digit". Anyway, quantization is not about which number system is best - virtually all computer systems we use today represents numbers in base 2. Quantization, at its core, is lossy compression. How do you go from a large model trained to high precision to a smaller model without hindering performance? This can be studied without needing to know the base.

Suppose you are using a decimal computer. You can ask yourself, I have a 128-decimal precision numbers, do I need that much precision? What happens if I just use 1-decimal precision by chopping off the 127 digits after the first decimal? You realize that there are two parts of an operation. The numbers involved (the operands) and the operation itself. You then ask yourself, if I keep one of the operands fixed (the original input), can I represent my 128-decimal precision neural network simply as a series of operations without the other operand? Perhaps only the most basic ones? Like: noops (add 0 or multiply by 1), increments (add 1), decrements (subtract 1), negations (multiply by -1), and clears (multiply by 0)? You count those numbers (-1, 0, and 1). There are 3 so you proudly proclaim you've made a neural network that only uses 0.477 dits. People get excited and confused because that is less than 1 dit which seems like a fundamental point. You further surprise the scientific field by finding a clever trick for getting rid of negations. You beat your previous record and now you only need 0.301 dits to represent your network. You are about to accept your Turing reward when the ghost of Claude Shannon appears and says "Why are you using a unit that measures entropy to mean how many symbols you have? If you insist, at least realize 0.301 dits is 1 bit." You are shocked when you realize 10^0.301 = 2^1. Reviewing Shannon's seminal paper, you are awestruck by Shannon's prescient comment "Change from the base a to base b merely requires multiplication by log_b(a).". You humbly give your award to Shannon. You keep the $1M since ghosts aren't as fast a new NVidia DGX. No matter how quantized the ghost is.

[1] - https://people.math.harvard.edu/~ctm/home/text/others/shanno...
You need to get permission to work and live in the US. To earn $320k you would surely be griding leetcode / system design questions?
Prolog language for PostgreSQL proof of concept
My response to your specific question is "I believe them when they say that but there is no need for this to be true, and in fact apparently Apple didn't do them in older chip revisions and I'm not sure that is a bug". However I do believe the authors were incorrect when they said "there is no way to disable the DMP on M1 and M2" (surely not involving DIT).
I agree in principal but not in practice here.

If you’re using a typical docker host, say CoreOS, following a standard production setup, then running your app as a container on top of that (using an already hardened container that’s been audited), that whole stack has gone through a lot more review than your own custom-configured VPS. It also has several layers between the application and the host that would confine the application.

Docker would increase the attack surface, but a self-configured VPS would likely open a whole lot more windows and backdoors just by not being audited/reviewed.
On the other hand, some schools started to ban smartphones on their grounds (at least here in Austria).
Just curious, why would you do this instead of,

export const someDep = new Dependency();

You can export a lot more of these statements.

and use it everywhere as these act as singletons in lets say a node JS environment.
It could also be evidence in a criminal investigation
> our setup file is approximately 200MB

> we keep things as minimal as possible

Wonder what's in that file that makes it need to be that large...
I wonder why no one mentioned Zstandard yet. It is 10x faster to decompress than most other formats and offers comparable compression ratios.
> One of the reasons for using containers is to wrap your security hardening into your deployment so that anytime you do need to scale out you have confidence your security settings are identical across nodes.

This is false. Or so you think your host is secured by installing Docker? And when you scale, how do you get additional hosts configured?

True is, when you use Docker you need to not only ensure that your containers are secure, but also your host (the services running your containers). And when you scale up, and you need to deploy additional hosts, they need to be just as secure.

And if you're using infrastructure as code and configuration as code, it does not matter if you are deploying a binary after configuring your system, or Docker.
Yes!! Great idea.. Keep ignoring them. So they feel more encouraged to do more fishy things. That attitude made todays internet pretty much swamp.
We need more good urban planning first, and the buildings will almost build themselves!
America may be a fascist white supremacist dictatorship for one day (lol) by November.

From the outside, when you’re in such a place, the calculus is different.
Americans don't need savings. They need a gay-automated communist revolution that will seize the means of automated post-labor production, and keep AGI out of the hands of billionaires. Sure, that sounds a bit crazy. But I'm right!
Literally no-one said that.

(Some of) the reasons why you would do this are explained (I thought clearly) above. None of this is security through obscurity.
Fully agree! Here in Austria some schools started banning smartphones and I hope more and more will follow (or even be required by law).
Well, they link to suckless for reasons why systemd is bad. So they most likely have no idea what they are talking about as suckless is known for being mostly factually incorrect.

For example, suckless claims "pid 1 does DNS" and link to https://cgit.freedesktop.org/systemd/systemd/tree/NEWS?id=2d... to prove this. That NEWS entry is about software not part of pid 1, but I guess reading is incompatible with a minimalist approach.
Thanks for making RhymeZone. I use it for wordplay and jokes when I'm posting.
No need, we have an ethically sourced Lena image here https://mortenhannemose.github.io/lena/
I thought this was about doing UI in rust, but it's just Javascript/react.

Also, in the demo screenshot, the margins of the agent/you labels feel off.
I think we have to assume that all community software is a target. The payoff for bad actors is too great.

For every one of these we spot, assume there are two we have not.
Money is a social construct. We have to make this point stand out more if we want our children and grandchildren to have a livable planet.

Thus, the monetary cost of any technology is easily adjustable by regulation - taxes, carbon dividends, subsidies, etc.

The energy cost is what I’m more worried about because physics doesn’t care, it just does its thing, both ways. We’re at .25C of warming per decade due to CO2 and reduced sulphur emissions. If clathrates go, it’s going to be worse still.

I’m confident the global leaders will figure this out eventually, but I’m very afraid the tech won’t be there when the money stops being an issue.
3rd party solutions can also add complexity you don't want. You need to keep up-to-date with their release schedules to have access to bug and security fixes, even though you would feature wise be happy with the older version.

Also these can add unnecessary complexity by having features you don't need. Or they might be missing features you need. Contributing up-stream can be difficult and there might be conflicts of interest especially for projects which have separate paid version.
Nope. Doesn’t work for any real Remote Desktop use case.
> You got yourself a one-way single-use FTL byte.

But you don’t.

If I have the entangled version of the MEASURED byte and measure, only I know I’ve measured it. The corresponding MEASURED particles on your side still appear fuzzy to you because you haven’t measured them. If you measure them, they will reveal their state which correlates to mine BUT that doesn’t tell you if I have already measured my side of byte or not.

In effect, the heads/tail coin on your side is still spinning even after I have grabbed my side of the tail/head coin.

You may get HEAD as your result but that only tells you that I will get TAIL when I measure on my side, not that I have measured it already.

If you and I agree to measure at the same time, then I will know your state by determining mine but this is the same as knowing your state because I know how a two sided coin works, not FTL.
I suppose Figma might just be beyond the "let's find the fastest/cheapest way to get this working" point. I believe it makes sense for a company in that stage to mess about a bit, find different (maaaybe even better) ways of doing things, keep the engineering work interesting to attract/retain talent, be OK with the inevitable waste involved in that game. If you're chasing the global maximum, you shouldn't get too obsessed with local maxima.

That said, I've seen plenty of unprofitable startups with high burn rate play this game. That seems a bit suicidal to me.
I personally won't be satisfied until GitHub changes their default branch name to using_the_lenna_image_is_violence.

Then, and only then, will I know that meaningful change has taken place.
Them be fighting words.

Tell some others orgs I've worked at that microservices are simple and they would laugh.

But yes it depends on the complexity of your domain/org.
I agree, perfection isn’t a realistic expectation. I also think effort spent building better defenses leads to fewer exploits over time than adding more of the same defenses. The marginal cost of bypassing a given defense is far lower than the initial cost to bypass a new defense
Bragging about this has to rank up there as the worst idea in the world. If your hole argument is taunting would be attackers with your wallet - saying you're more overprovisioned than the traffic they can send, you're just threatening them with a good time. At another time in my life I'd take this post as an invitation, even, specially because the numbers shared are super low.

I've had 3 situations where my place of work was under DoS attack, in the 3 cases I managed to identify an email address and reached out asking why they are doing it, and if they want to talk about our backend. In 1 case, the "attack" was a broken script by someone learning how to program, the other two were real attacks and one of them just immediately stopped once they knew we knew who they were, the other actually wanted to chat and we emailed back and forward a bit.

99.99% of the time a DoS is someone who is bored. Talking to them tends to work.

Edit: there's some questions about the situations so I'll expand:

- The first was not a real attack, and they were doing the network calls through their authenticated API key. This was early days of a YC startup so of course there was no rate limiting in place. In this case I exchanged 2 or 3 emails and after they sent me their python script I sent them back a patch and they finished their scraping without bringing us down. Never heard from them again

- The second was at a different company, we were getting targeted to distribute email spam, because at the time we'd allow people to invite their colleagues as members of their account, and some people associated with casinos based out of Macau automated a way to spam their casinos by putting the URL in the name of the account, which went out in the email notification. I contacted one of the admin emails of one of the casinos I found and they stopped and disappeared. In this case we also locked all their accounts and prevented further logins + emailed them to reach out to support if they thought it was a mistake.

- The third one was more difficult, they weren't using any account, so all we had was network. At some point on the second day though they changed how they were sending some of the calls, and by mistake or not leaked their Telegram username. I installed telegram and talked to them, they trolled me a little bit, but stopped very quickly and didn't start it again. This one was very amusing to people in my company because I had told them this approach would work but a few of the big wigs didn't want me to do it (they didnt have any reason other than "obviously won't work to just talk"). I just did it anyway.

To be clear, you shouldn't reach out with some threats or how you're so good that you found them. My approach is of genuine curiosity, and my literal first message to the telegram person was:

"Hello, how is it going? I work at <companyname> and we're seeing a load of requests originating from your user here on telegram. Does this make any sense to you or do you think I might have the wrong person?"

That's it!
Nope. Why would I want an extra agent on each target machine?
https://twitter.com/VinciusMedeiro6/status/16748901398798458...
Far cry src leaked recently
It's going to a point where that directly find out the person behind it is cheaper than fix the bug. People nowadays don't pay respect to the hard working people anymore
Lawers are unionized but just name it something else. Etc.
The TL;DR of my comment is "I personally enjoy implementing automated solutions to relatively-low-volume abuse, but as long as it doesn't cause you any capacity concerns, I fully understand ignoring it, since it's hard"

Using that as a reason to assign me responsibility for the state of the internet seems... slight hyperbole?
Atkinson engines have poor power to weight ratio at maximum efficiency, if you’re going to maintain that 40% then the engine needs to be oversized and under utilized. This is why many hybrids have seemingly much more power than they need. Thus the 194HP Prius vs 75 HP on a CX-90 plug in SUV.

Also it’s not just that you can have extra Li+ it’s also pushing around less dead weight when the engine is off. So you can get fairly close to a 50 mile range difference depending on exact setup.

Alternatively you can have a smaller Atkinson engine and a larger reserve on the battery, but that also costs range while still being heavier.
I use KasmVNC with some container apps that bundle it, but that doesn’t really match RDP’s feature set.
On the other hand. If by using containers it has become more feasible for your employees to use something like AppArmor, the end result may be more secure than the situation where the binary just runs on the system without any protection.
It's a good way to get them to shine their main beam headlights in your eyes in retaliation as well.
The worst thing reporting an IP can do is increase your ranking on scamalitics.

Cgnat is becoming common on home internet. You can share an IP with up to 128 other people.
Hello,

Github just disabled the repo : https://github.com/tukaani-project/xz

Do someone have an up to date fork to see the project history ?
off topic but you guys have done solid SEO. You query anything related to SQL/syntax and tableplus will be in front of you.
Then it's an actual advantage.
Make it more convenient than a touchscreen and maybe, also make it so you don’t look like a complete ass when you use one