skysight-inc/HackerNews huggingface dataset:
Thank you for playing with this tool and for sharing your feedback. Does "once" make the description of the block meaningfully different from "once more"? If so, I would like to understand this better.

A repeatable block is executed once by default and once more when ‘]’ is encountered. For example, consider the following CFRS[] code:

[FFFF

Here the block is entered and four cells are drawn. The block is not repeated. But now consider this:

[FFFF]

Here the block is entered, four cells are drawn, and the block is repeated, so four cells are drawn again. A total of 8 cells are drawn.

There are others too who have found the description of the ‘]’ command to be a little confusing, so I wonder how I could refine its description to improve clarity without sacrificing accuracy.
I was reading it OK, but my browser performance kept deteriorating as I scrolled, until it crashed. Then I opened in another browser with NoScript and all was well.
Advertising is a cancer on society. Any limited good it does is far outweighed by the bad.

In a parallel timeline the smartest minds in the world are fixing climate and medical problems, further the limits of human knowledge and exploration, or even just making fun things to play with.

In this world they are trying to outdo each other in brainwashing people to improve the profits of companies larger than most countries.
> But that's the thing: deciding how software is built and which features are shipped to users _is_ under our control. The case with xz was exceptionally bad because of the state of the project, but in a well maintained project having these checks and oversight does help with delivering better quality software. I'm not saying that this type of sophisticated attack could've been prevented even if the project was well maintained, but this doesn't mean that there's nothing we can do about it.

In this particular case, having a static project or a single maintainer rarely releasing updates would actually be an improvement! The people/sockpuppets calling for more/faster changes to xz and more maintainers to handle that is exactly how we ended up with a malicious maintainer in charge in the first place. And assuming no CVEs or external breaking changes occur, why does that particular library need to change?
Yes, exactly this. I certainly don't claim to have any big answers, but at the same time I think these problems with trust were very clear very early on.
PDM = product data management
ERP = enterprise resource planning
SAP = The name is an initialism of the company’s original German name: Systemanalyse Programmentwicklung, which translates to System Analysis Program Development.
WBS = work breakdown structure
COTS = commercial off the shelf
WMS = warehouse management system
CRDT = Conflict-free Replicated Data Type

Some of these acronyms are quite old, but continue to be used as they make sense to the people in those spaces.
Hey Daniel! The VRAM is still the same as a pure n-bit model would take. Because we only need meta-data for a single nn.Linear at a time, you only need an additional (3GB-1.7GB)/224 = 5.8MB. If we compress the meta-data as well that would become much lower.
Nearly every modern IDE and diff viewer instantly highlights this though? I doubt this would get far.
Yes, either that or splitting it out into a "libsdnotify"

But since it's only a few lines of code most seem to think that unnecessary.

It should be noted that systemd actually fixed this a few days before the backdoor was pushed

https://github.com/systemd/systemd/pull/31550#issuecomment-1...
If you suspect a binary is compromised, running it to ask its version seems a bad idea
This is incredibly naive. Anyone that thinks that pressure doesn’t work is exactly who I’d personally put top of my list to try to social engineer. Everyone is human. Nobody has infinite strength against persistent pestering. Everyone is capable of finding oneself in a scenario where they feel unsolicited responsibility. All you’re saying here is that you haven’t personally experienced it.
A Review of Surgical Capacity Building Approaches in Conflict-Affected Settings
Agreed it’s a decent way to create a “map” of vulnerable projects. But it’s over-fitting the MO of adversaries - plugging an arbitrary hole.

Why not play into the strengths of OSS instead of trying to replicate frictionous trust models from elsewhere?

Like, listen to ourselves. We are admitting here that open source software is not feasible to audit? Like did we just accept that an adversary can basically smuggle exploit payloads in plain sight?

Can we at least try to simplify and reduce the messiness of checked in generated code, irreproducible builds, and magical binary blobs, conditional compilation, “ifuncs”? Wtf? Granted I’m not a domain expert in this area, but I’m horrified by all the complexity for what I understand to be a compression library.

I would much rather play whack-a-mole with obscurity, which as a side effect is great for software quality overall.
You absolutely should NOT automate this. If you do, you then need to manually check that automation with the same frequency- so you haven’t gained anything!
Show HN: ProductivityXP – Earn XP from your to-do list
I made a list app.

Every item you check off gives you XP. Every 100 XP you earn, you level up.

Your reward?

A higher number on your Profile page to show off.

Features:

- Create multiple lists

- Add optional notes to your items

- Schedule optional alerts for your items

- Star items to easily track them

- Track the total number of completed items across all lists

- Keep your daily visit streak going as long as you can by checking on your lists every day

- Dark mode

- No ads

ProductivityXP doesn’t require an Internet connection. It works completely offline.
Can we stop the ridiculous C++ fearmongering? You can make vulnerable software in any language, and you can do social engineering on any software.
But what's the advice here? "When people are trying to peer pressure you, don't accept?"
What I find curious is, everybody is acting like, yeah, we found that one attempt! But there gotta be more. And this is only open source. At Google, Meta, Microsoft there gotta be the same forces at play.

So yeah, congrats to everyone involved discovering this, excellent work, really! But how sure can we be, that there was no other successful attempt?
There's a graph of consents in this link that shows a huge drop in consents in last two years:

https://www.stats.govt.nz/information-releases/building-cons...
> If the new contributor did it, did they become an xz maintainer with the aim of acting maliciously?

Is no one asking if there was a state actor behind the contributor? My question is what was the ultimate end goal, and who motivated this exploit?
How does this affect Mac users who had the vulnerability?
The Aeolus mission: https://earth.esa.int/eogateway/missions/aeolus

> The Aeolus mission objectives were to provide accurate global measurements of winds from the surface up to 30 km
“oh come on please it's easy just /etc/init.apt-get/frob-set-conf --arc=0 - +/lib/syn.${SETDCONPATH}.so.4.2 even my grandma can do that”
Yeah, I use rsync with `-cavin`, if the output includes `>` or `<` then there are differences in checksums.

#!/bin/bash
hostname=$(hostname)
checksumFile=/tmp/checksum-file.txt

rsync -cavin --info=name2 --no-perms --no-owner --no-group /srv/data/photos/ user@remote:/media/data/rsnapshot/daily.0/srv/data/photos/ > $checksumFile

minimumSize=5000
actualSize=$(wc -l <"$checksumFile")

if [ $actualSize -ge $minimumSize ]; then
fileDiffs=$(cat $checksumFile | grep -e '<' -e '>' || echo 'all checksums match')
else
fileDiffs=$(echo $checksumFile is too small)
fi

echo $fileDiffs
Either you do not understand the meaning of hard or you have a very quirky way of trying to be sarcastic :)
Imagine a state actor offering retirement money and a plane ride to a non-extradition island nation for a few commits. Assuming the contributor is using a VPN already, no one would know they were adding surreptitious backdoors in their code.

The only solution is to scope security relevant functions and add a multi stage formal verification process before freezing the commits. This assumes no collusion.
Not as bad as the fallout is going to be. Already some people are calling for mandatory identification when contributing to open source projects. This will, of course, have a chilling effect on FOSS contributions, while it seems unlikely (to me) that this would improve security in any meaningful manner.
I think we should assume there as at least one or more other successful attempts.
“Without work there is no life…”

That’s not something you’re going to hear from someone in their 20s or 30s, even a few decades ago. This is an attitude that you develop as you get older and become more experienced. It also helps if you’ve already checked a lot of boxes along the way (family, success, and so on).

Sure, Chang was the right person at the right place at the right time, but TSMC could only be built by someone in their 50s. Someone who understood from experience that the work is more important than the accolades because they lived it.

Incredible story end to end.
> why take so long to attack

First they need to gain some credibility. And they also need to obfuscate what they were trying to do. The payoff if they were to succeed is potentially enormous, so it makes sense to do things slowly.

> and why do it in xz?

xz is almost a perfect target- undermaintained, complicated code that isn't well understood by many people, deployed and used widely.

> Or are they also attacking lots of other systems, perhaps under other names?

The answer probably depends who the attacker(s) are, and what sort of funding or other motifivations they have. We can only guess.

> 4. And what can we do about these attacks?

This is a big unanswered question. I haven't seen any great suggestions yet. We were very lucky with this particular attack.

> How can we build a system that isn’t ultimately brought crashing down by one or two bad actors?

The complexity involved in this attack suggests that it was probably a group, IMO.

> 5. Small technical detail I haven’t spotted in writeups: was the attack commands signed in some way so only the attacker can use it and the world can go hunting for a smoking gun cert that matches the attacker?

Yes, sort of. Filippo's thread has a good description: https://bsky.app/profile/filippo.abyssdomain.expert/post/3ko...
eeeeff
Wiretapping: In re Meta Pixel Tax Filing Cases [pdf]
In IT infrastructure outsourcing, running the old infrastructure unchanged but cheaper is sometimes called „mess for less“. Now, we can also generate new mess for less.
In any organization there will be a minority group of highly organized people with most of the power. We call them elites.

But there’s a difference between aristocrats and oligarchs. When people reference the deep state they are referencing what they believe are oligarchs that are self interested and use the state to advance personal goals of power and wealth. What they want but can’t usually communicate is an aristocracy that takes care of them and the country.

Oligarchy decays into populism eventually (years, decades, more?) as we see in many places now. Populists will call for a monarch. This has happened in El Salvador.
This underscores how important XMPP is compared to other social messaging applications.

If a social app hasn’t been banned in China, what did they comply with to not get banned?

Something to think about.
Does this surprise anyone with a modicum of intelligence?

In the past 40 years we went from:

1. PCs (real productivity gain) as now all every home and office could afford a computer running important things like spreadsheets and word processors.

To

2. The world wide web. Huge economic and productivity gain from making information acquisition and communication cheaper and more readily available. The apogee of the world wide web was probably in the early 2000s. Google search worked. You could find what you were looking for. eBay and Amazon worked.

To accelerating bullshit based on advertising.

3. Facebook, Google SEO spam, Twitter Reddit. Increasing programing frameworks all of negligibly marginal productivity and economic value.

4. Crypto currency. For some governments world wide turned a blind eye to the creation of private tokens whose only real use cases are speculation (gambling, distributed ponzi), money laundering and or other black and grey market activities of negligible or negative real economic value.

To now
5. "AI" trained on Reddit posts, Wiki articles, stack posts, and Google SEO blog spam. "AI" is basically a glorified, hallucinating chat bot at this stage. Nothing like real intelligence or capable of producing trustworthy reliable output at par with a human expert or a Google search from 20 years ago, before the degradation.

The sigmoid curve strikes again.

Silicon Valley in bringing the world microprocessors, PCs, the commerical WWW. Since then the ratio of bullshit to real innovation has increased at an accelerating rate. Eventually there will be a profound economic.restructuring of the area more in line with reality.

The only reason why it hasn't happened yet since 2009 to present when bullshit proliferated was low interest rates and too much money chasing gains with delusional business propositions.
The real question should be how many more similar things there are in the entire
Linux codebase
I would bet good money there are more that haven't been detected.

Every intelligence service in the world wants one or more.
Many can hire truly bright programmers who will contribute to Linux
over years, doing nothing nefarious at all, to build a trustworthy profile.
and even contribute meaningful and positive features.

Then, maybe 2 of 3 trusted profiles make tiny changes as part of a much larger valid contribution. each one a tiny adjustment, each one not particularly interesting from a security point of view, unless you look at all 3 at the
same time, and of course they were not added at the same time.

I am quite certain they have people who are working at Apple and Microsoft
as well with the same mission.
Your first concern makes no sense. You can have specific hardware that is widely available on home computers. In fact, you soon won't be able to buy a computer without them.
More like 1 to 5%, I doubt any higher percentage bothers to update
Thank you! Yes, for the puzzles we would up having to constrain the board to a size that wasn't too egregious when sharing emojis... The classic single player has a bit more room to breathe :)

(Thanks for pointing out the font — I do have an issue for that (https://github.com/TruncateGame/Truncate/issues/111) so it's nice to get validation on its importance)
Imagine this way. You have three papers stack together. The top paper is the duvet. The bottom two paper are the cover. If you flip the bottom page over the other two papers, you have the duvet paper between the cover pages. For the real cover, you can not do that because the three sides are stitched together. So you roll the them together then you can invert through the opening.
The age limit of 40 kind of ruins the Fields medal as the top prize tho. Sure, getting it is absolutely huge, but what about the people whose work's value is apparent only after decades?
From a different comment of mine:

> It baffles me how such an important package that so many Linux servers use every day is unmaintained by the original author due to insufficient funds. Something gotta change in OSS. I think one solution could be in licenses that force companies/business of certain sizes to pay maintenance fees. One idea from the top of my head.
Zoomable Circles, a Svelte component for hierarchical data
The portion of the article the previous “17x” title referenced:

“In a presentation earlier this month, the venture-capital firm Sequoia estimated that the AI industry spent $50 billion on the Nvidia chips used to train advanced AI models last year, but brought in only $3 billion in revenue.”
I do have this automated, but the checksum output is posted to a kind of watchdog service. Every day I get an email that says everything is as expected, or not.
I need to google every time to find a good process for hashing files and comparing across disks? Not only that, but remember to do it frequently enough?
The next step will be no contributions from people from countries like China, Russia, North Korea

Won’t stop state actors of course, just normal people (well ok there are only state actors from NK. And exiles)
> . If Microsoft stops laundering revenue through OpenAI

Not sure this is the phrase you meant as no one is accusing Microsoft of laundering money via OpenAI.
It’s pretty intellectually dishonest to call this a big win for open source. It’s completely and utterly bonkers that this was noticed. Unthinkably low odds. There are certainly other backdoors out there like this, already in production.

If this happened on a proprietary software project, …I have verified proof of identity documents for everyone on my team. These can of course be faked or fraudulently obtained, but it heightens the barrier to entry and leaves more of a paper trail. That’s not something that we have in this scenario. There’s way more give and take between open and closed source than open source purists make out. They just like the idea of being able to see source code.
I don’t really think so. People were already starting to speak over private, non indexable channels (like discord) before AI blew up.

More and more people will just stop sharing meaningful creations in the open for fear of AI groups effectively stealing it for training data.

Eventually these AI groups will need to use more controlled or synthetic datasets, which will stall or destroy the progress these models have been making.

AI is literally eating its own tail.
> That's technically an ad

I don't consider it one. My definition of "ad" seems to be somewhat different.

If I go to someone's website, it's because I want to learn more about them and what they have created. So when I see information about the books they have written on their websites, I don't consider that to be advertising at all. When I go to someone's GitHub repository, I don't consider the sponsor button to be advertising. If I click it and their sponsor page opens, I don't consider it to be advertising. It's just information. I actively sought that information and I got exactly what I asked for.

Advertising is when somebody pays money to put that information in front of your eyeballs. You didn't look for it, you didn't want it. You're busy, you're actively concentrating your mind on some other activity. They don't care, they don't respect you. They go to you and interrupt you with their irrelevant nonsense. That's advertising. Can't even cross the street without having your senses assaulted by strategically positioned billboards.

Last time I expressed this on HN, people tried to convince me that everything is marketing and advertising somehow. If you exchange business cards with someone, it's somehow advertising. I just don't see it that way. There's no way a pleasant social interaction will ever be in the same category of toxicity as advertising on the web.
This particular approach of hooking would be much harder; but a malicious xz has other options as well.
It's already in the code path used by dpkg when unpacking packages for security updates, so it could just modify the sshd binary, or maybe add a rootkit to the next kernel security update.

It seems foolish to change our systems to stop one of the steps the attacker used after their code was already running as root; the attacker can just pick something else; as root they have essentially unlimited options.
So how is that relevant in the context here. FB did not clearly request to be able to read all traffic (encrypted and nonencrypted) so how could they get consent. Unless you're arguing, "we will monitor your Internet usage", clearly means we will man-in-the-middle all your connections. Which would be a weird take.
#8855aa
Listened to podcast linked here: https://news.ycombinator.com/item?id=39878136

Talks about Ontario having immigration of 1.2 million but 800000 is temp visas for study.

Be careful with that million population growth number - it might not mean what you think!?
As a colombian, I can confirm.

Yet there are people who still idolize Pablo Escobar or think that becoming a drug lord is the only way to be wealthy - besides being a (corrupt) politician, that is. FARC leftovers think that way and that's why they won't stop doing crime.

The criminal organizations that came from Venezuela ("Tren de Aragua", "Los Satanás") aren't helping either.
I did that in the early 90s. Was only a 4-bit job but it mostly worked! Edit: it only ever ran one program which was to count to 99.

There is a whole community of these machines: https://www.homebrewcpuring.org
Brew was installing the affected version 5.6.1 of `xz`. They have in meantime rolled back the version to 5.4.6
There's not enough information yet to know for sure what the effect is / was on systems running the backdoored version.
> They can't do certified translations for bureaucratic matters, but they are great for everything else, and much faster than hiring a translator.

Yeah, the bureaucratic situations are the rough ones. Here's a piece about automated translation causing issues for Afghan refugees: https://restofworld.org/2023/ai-translation-errors-afghan-re...
Yes, he wants to stop using insults, which I think is good. But he still won't tolerate BS, or timewasting.
We can never be sure about that. One’s threat model has to assume that Mallory can find a way in. Backdoor’s are not super common, but there will always be 0-days. Security operations need to be setup with this in mind. Design your infra for defence-in-depth. Logging and access control is very important. Log everything that happens in your systems. Don’t use long-lived credentials. Don’t give people more access than they need. Audit users’ privileges, remove privileges that are no longer required. Try to make your logs tamper-proof. (Perhaps keep copies of the logs offline?)
The backdoor had a check to only affect .dem and .rpm based distros. macOS /should/ be fine.
I've read that some fake sound chips from eBay actually used a gate array. Not original parts, not a 100% equivalent drop-in, but close enough to work & convince most buyers. Don't know if true but sounds plausible. And if so, a (relatively) simple cpu wouldn't be much of a stretch.

Ken's article doesn't mention it, but there's another reason to use a gate array: pre-fabrication, and through that, easier stock-keeping.

Say you have ~100 different IC's like the one described. One could then do all the manufacturing steps to produce eg. 100k of those gate arrays, except the last fabrication step. And possibly keep a large stock of those 'blank' gate arrays.

Then (when it's known which of those 100 IC's is needed), apply only the last production step to those 'blanks', and presto: selected IC ready - in large volume if needed. Or produce IC's where original part has become hard-to-find.

For a mil-spec part, that flexibility might be among reasons to go for a gate array.

These days, something like a fuse-based FPGA might be used instead?
GitHub 95
I am also doing borg, restic, tarsnap currently (evaluating Kopia) but of late a fatigue has been setting in. My best backup (and in fact recovery) experience has been with CrashPlan (Personal) really. Nothing comes close to it somehow. Tinkering, deduplication, compression all are hunky dory but at the end of the day I just want to be able to easily visualise what I do and what I need and what I am searching et cetera.
MSOS Concept
Well… what do you think character AI is?