skysight-inc/HackerNews huggingface dataset:
Probably more than 100x for inference. Not only are you drastically reducing the number of bits and replacing float math with integer math, you can do matrix multiplication with only addition (as pointed out in the BitNet b1.58 paper). Additions require a lot less hardware to implement than multiplication. Adding one-bit or two-bit numbers requires barely any hardware at all. A traditional two-bit adder without carry bit is three xor gates and an and gate.
> there are plenty of things the charity might spend it on that are in your financial interest

How do you think Carnegie's libraries across the country benefited Carnegie financially?
But they almost got away with it. We could have found ourselves 5 years later with this code in all stable distribution versions, IoT devices etc.

Also, we only catch the ones that we ... catch. The ones that do everything perfectly, unless they come out and confess eventually, we don't get to "praise" them for their impeccable work.
We have a few different ideas but hoping to get signal from the folks here on what people would like to see.

Some sort term ideas:

* Auto-categorization. We're seeing most people just have "starred" places, and that's really it, so having some way to suggest a better breakdown of places should locations.

* Adding the ability to sort results by various criteria (distance, recently viewed, rating, alphabetical)

Some longer term ideas:

* Making the experience more social, but more like "iMessage" social not "Facebook" social, if that makes sense.
A culture fail ruined Boeing
> One of the objections that many people do not understand, is that systemd adds complexity. Unnecessary complexity. Boats full, loads full, mountains full of complexity.

Complexity that would otherwise be distributed to a sea of ad-hoc shell scripts? systemd is a win
I thought it was the horrible compression and oil burning. Apex seals seem to last if you don’t do silly things to them but you can’t solve inherent issues with the cycle design.

For comparison, rotaries get about 100psi of compression, a modern gas car can more than double that. More compression, more efficient burn.
https://www.goodreads.com/quotes/21810-it-is-difficult-to-ge...

For example: the last couple decades was an intentional effort by politicians and VCs to extract a much as they could. Large number of people here still working for and agree with such a system of exploitation.

To paraphrase Sinclair again, we love socialism just not the label. We want to solve problems but refuse to do that and capitulate to demands of middle men who don’t do the work.
Yup these jackasses don’t realize the irony that their very spamming for money is the reason many of us will never give money again.
> Our capitalist world economy equates wealth based on extraction, not preservation

Why is there no shortage of corn, cows, pigs, and chickens, then?
Yes, it absolutely is reasonable to scold strangers for things like this, especially if you’re an employee who sees it happening regularly.
> By releasing such patches, others can get them for free while it took you significant effort

Conversely, you get others’ patches for free without significant effort on your part so it’s still in everyone’s interest to contribute.
Packages in a Linux distro are not built on my machine, they are built by the distro in a sandbox. Every time I type "cargo build" I am potentially running arbitrary code downloaded from the internet. Every time I type "make" in an Autotools program only my code runs.

> not requiring me to be an expert in another language just to audit it.

Do you do that every time your Cargo.lock changes?
As someone who has been in a fair few discord chats with soldiers, I'd beg to differ...
Good explainers for cargo ship issues, etc. following Key Bridge collapse
Like others, have been paying attention to news of the Francis Scott Key Bridge collapse in Maryland. Here are some sources of good info:
* National Traffic Safety Board (NTSB) (pressers and b-roll) https://www.youtube.com/@NTSBgov

* What is Going on With Shipping? https://www.youtube.com/@wgowshipping

* Dali Timeline from Data Recorder in Striking Francis Scott Key Bridge in Baltimore, March 26, 2024, What is Going on With Shipping? https://youtu.be/-rxKQ8Tr94s?si=U18ujW-hAjI7HAmS has links to other YT channels, such as Chief MAKOi https://www.youtube.com/@ChiefMAKOi and Bryan Boyle https://www.youtube.com/@BryanBoyle
The MGM Hack That Brought Chaos to Las Vegas
> early [voting]... solves many problems without causing any new concerns.

You don't trawl political discourse much, do you? Early voting is specifically called out as a problem by people who claim that their political enemies are voting multiple times. Whether or not that's a bona fide concern is somewhat irrelevant.
It's not like the ICE doesn't do anything at low speeds, HSD uses the two motor-generators like a gearbox
This is a semantic argument that I have no real interest in arguing.

Call it genocide, call it ethnic cleansing. Genocide as a criminal charge is mostly a political matter.

California literally admitted that they targeted citizens of Mexican descent for the explicit purpose of illegally cajoling them into emigration and enforced deportation. You learn about it euphemistically as "repatriation" (if at all because almost no HS curriculum teaches this) because oopsie.

If the USSR rounded up all the Japanese and put them in a camp, you wouldn't hear the end of it in the West. Roosevelt himself used the term concentration camps. You learn about it euphemistically as "internment" because "they had a good reason to do it, and sometimes you know we get things wrong!!". An argument that can really only be used if you prelabel good guys and bad guys.

The main difference between US camps and USSR camps is that the US camps were nicer and had food.

The quality of repression scales with the wealth to some degree. The USSR couldn't support the same quality of life for their prisoners that the US could.

Today the US refuses to provide the same quality of life for their prisoners that less wealthy OECD countries do provide.
https://archive.is/Phqit
There was a discussion two months ago (https://news.ycombinator.com/item?id=39271472) about a paper on using neutrino beams to destroy nuclear weapons, which showed that neutrinos can be dangerous.
> How on earth does one App man in the middle another App’s traffic?

By providing a VPN

https://beyondmachines.net/event_details/facebook-spied-on-c...
Sounds like these guys didn't use custom kernels, but BitNet did.
Like the 2003 Linux kernel attempt https://lwn.net/Articles/57135/
Oh! The Batmobile!
I know I was interested in random noise inputs and test oracles that could classify them into known equivalence classes for inputs/outputs as a way to verify equivalence class boundaries. That was in the 90s. But it's an example of similar stuff that's not "fuzz testing," per se.
I’ve run into a few people in my life who weren’t allowed to play any video games as kids. When they finally played one for the first time, they wouldn’t let go. It was wild. One guy basically lived in my dorm room for 2 weeks playing Metroid Prime on the GameCube, his first game ever. I thought I was just letting him play my game for 5 minutes, but no, he beat the whole thing and I never ended up playing again, because I didn’t want to start over once he had finished.
When we talk about effective use of subsidies, I often wonder if subsidizing these kinds of things would help things way more than just handing out money in various entitlement programs.
It's ironic how propeller airplanes evolved into jets for for thrust and back to propellers.

(A ducted fan is still a propeller.)
Well I’m not sure if it’s just greed at the level at Amazon, Microsoft etc packaging your work and take all the support money from their vast influence.
I didn’t say we create beauty, I said we experience it. What is the point of beauty if no intelligent creature is around to appreciate it?
Playboy image from 1972 gets ban from IEEE computer journals
I got the same idea. On XZ dev mailing list there were a few discussions about "is there a maintainer?" 2-3 years ago. It's not hard to find these types discussions and then dedicate a few years of effort to start "helping out" and eventually be the one signing releases for the project. That's peanuts for a state actor.
There are many good reasons to write tests for your code: catching bugs, preventing functionality regressions, defining better interfaces to your modules, the list goes on.

But one reason isn't discussed quite as frequently that I like to call "the virtuous cycle of testing." Put simply, this virtuous cycle is the idea that writing more tests makes it easier to write other tests in the future.
Years ago I ported some of the Java to Go because we didn't need any of what the Java client was doing:

https://github.com/wwt/guac
Amazon Linux customers are not affected by CVE-2024-3094
Maybe evolutionary algorithms instead? Hasn't proven super useful historically, but maybe at the scale of enormous LLMs it will be?
Priuses do a power split where the engine drives the wheels and the motor-generators act sort of like an electrical CVT. You would have to be out of the power band a lot to make a series hybrid more efficient than a parallel hybrid. The reason locomotives are series hybrids is just that mechanically switching that amount of power isn't practical. To my surprise, even off-highway mining trucks mostly use mechanical transmissions.
My git commits are sometimes in UTC, depending on which computer I make them from. Sometimes my laptop just switches timezones depending on whether I'm using wifi or LTE. I wouldn't put much weight on the timezone.
In the early days of the pandemic, the retail chain I worked for had a curbside delivery only policy. No customers in the store period, you had to call us and we'd bring your whatever out to you.

No amount of signage on the door would stop people walking in. I stacked a bunch of boxes physically blocking the door and people still forced their way in.

The only thing that worked was putting a strip of blue painter's tape across the doorway directly at eye level.

I have long since stopped trying to make sense of other people's behavior.
That might have been true in the past but it's not hard to PoC with elastic using docker compose.
Reminds of the note at the bottom of Fish releases. It's there because the build system cannot determine the current version for some reason. Hopefully that will go away now that they have switched to a different language / build system. The custom tarball is used by Arch Linux at the very least.

https://github.com/fish-shell/fish-shell/releases/tag/3.7.1

https://github.com/fish-shell/fish-shell/issues/7772#issueco...

https://gitlab.archlinux.org/archlinux/packaging/packages/fi...
PGP is more famous for "web of trust" topologies, not chains of trust.

For all of their nerd cred, key parties didn't accomplish very much (as evidenced by the fact that nothing on the Internet really broke when the WoT imploded a few years ago[1]). The "real" solution here is mostly cultural: treating third-party software like the risky thing it actually is, rather than a free source of pre-screened labor.

[1]: https://inversegravity.net/2019/web-of-trust-dead/
Finally. I believe she asked people to using her image long long ago.
Fuzzing is guesswork. I see this attitude: because an unknown bug could possibly exist, therefore it could be a high severity bug and is then worthy of expending a lot of time and effort to discover.

To beat all odds and discover something you can't predict, you don't even know what it could be. Some effort should be done to reduce the problem space.

In the given example, I don't see why you need to test input at the cli level when access control and input sanitation should be verified already using known parameters that reject all unpredictable input. Obviously, certain combinations of input are more dangerous than others, and at the very least, those individual systems should have focused parameterized tests, and that set reduced from the random fuzz possibilities.

Exploratory testing on highly secure, safety prioritized systems is one thing. Sure, chaotic testing like this has a place, in a very specific, hopefully highly structured system. Even then I would use it only after every other type of testing.

When someone wants to test every input possibility with random noise I roll my eyes. Test what you know is a threat first, achieve solid coverage, run tests at every stage of development and then maybe we can talk about fuzzing. Is the system actually functioning as it's intended? Are all the happy path use cases tested? Are you sure about that? Boring, I know.
The Signal Android app has (had?) reproducible builds. You can see what is on the site and in the App Store is the same as when built from source. One person doing this provides some confidence for everyone else.

Still, I’m less confident in saying any other company fulfill’s Matter’s promise than saying they aren’t.
if you're rhetorically asking whether caffeine is as addictive as nicotine, then we all obviously know that that's impossible to quantify.

but the caffeine itself is a far cry from any of the contents that are of dubious safe consumption however. see non-nutritive sweeteners, marketed as being "0 sugar," as one such example.
Good cop bad cop play maybe.
I love being called naive.
Kinda relevant, as I saw few comments about how safer languages are the solution.

Here[0] is a very simple example, that shows how easy such supply chain attacks are in Rust; and lets not forget that there was a very large python attack just a few days ago[1].

[0] - https://github.com/c-skills/rust1

[1] - https://checkmarx.com/blog/over-170k-users-affected-by-attac...
As a bad analogy, I've heard the difference between EEG and implants described as pointing microphones at the outside of a building vs having them inside the room.
The McMurtry Spéirling is not street legal and it costs $1 million.
Understood that that's the conceit, but referring to purely the initial season on Netflix, it would be perfectly substitutable to have Evans speaking not /through/ a Sophon, but /to/ a Sophon -- a sufficiently-intelligent, sufficiently-aligned computer that can represent the San Ti interests fully, and react as a San Ti would. Nothing that has happened in the story /so far/ requires a real-time update on the status of the San Ti fleet, or otherwise an actual round-trip communication; it could all be incorporated into the San Ti model of a sufficiently advanced AI for the purpose of representation. (Even as an AI skeptic, I do think that such an AI is less of a technical reach than FTL communications.)
More reproducible builds, maybe even across distributions? Builds based on specific commits (no tarballs like in this case), possibly signed (just for attribution, not for security per se)? Allow fewer unsafe/runtime modifications The way oss-fuzz ASAN was disabled should've been a warning on its own, if these issues weren't so common.

I'm not aware of any efforts towards it, but libraries should also probably be more confined to only provide intended functionality without being able to hook elsewhere?
I ran into this about 8 years ago. I was using a new dev tool, and the docs said there was a UI element to do something. I looked, and looked and just could find what they were talking about. So I contacted them to ask what the deal was, and they sent me a screen grab. Turns out what I was looking for was in a weird rectangle embedded halfway down the page and centered on the 3rd quartile of the width of the page.

Exactly where someone would stick an ad into an HTML page. They had put a box around it and styled it a little differently, so my brain tuned it right out.
Tibbles was the first cat brought to the island, and she had kittens, hence the feral cats.

Tibbles didn't kill them all, but bringing Tibbles doomed the species.
Google has diversified a bit, even if most revenue still comes from ads. About half their revenue comes from search, and the rest mostly from YouTube (10%), cloud (10%) and Android (25%, incl. a major chunk from the Google Play store).

Their search revenue is potentially at risk from people using LLMs instead, but no reason they can't integrate ads into Gemini, even if they haven't figured it out yet. Lots of opportunity for AI: selling API access, Gemini subscriptions, product licencing (Apple apparently interested, Android potential too), etc.

Definitely a mismanaged company though.
So the attacker put the payload into the tests folder of the compression library and injected it upon build via some arcane build script? Kudos. That's quite a smart way to hide your backdoor.

Nevertheless, they got caught. So big respect for the analysis. Amazing work.

That being said, what does this attack tell you about the future of software security? Free software could easily be compromised by having a highly paid team create such a payload and then convince some maintainer, one way or another, to deploy it.

How do we back off from that cliff?
Lottery winnings and costs in the U.S. are treated exactly the same as any other gambling winnings and costs.

You can deduct the costs of a lottery ticket but only against any winnings. You cannot deduct it against other income.

https://turbotax.intuit.com/tax-tips/general/everything-you-...
At least one version could run as a series hybrid or as a torque combining hybrid, depending on which clutches were engaged.
Main discussion thread here: https://news.ycombinator.com/item?id=39865810

Backdoor in upstream xz/liblzma leading to SSH server compromise (openwall.com)
1848 points by rkta 5 hours ago | 654 comments
My partner with a PhD in particle physics says this all the time about herself
What type of confirmation do you want? The documents aren't going to be declassified in the next couple of decades, if ever.

I've never heard anyone claim that Dual_EC_DRBG is most likely not intentionally backdoored, but there's literally no way to confirm because of how its written. If we can't analyze intention from the code, we can look at the broader context for clues. The NSA spent an unusual amount of effort trying to push forward an algorithm that kept getting shot down because it was slower than similar algorithms with no additional benefits (the $10 million deal specified it as a requirement [1]). If you give the NSA the benefit of the doubt, they spent a lot of time and money to... intentionally slow down random number generation?!

As an American, I'd prefer a competent NSA than an incompetent NSA that spends my tax dollars to make technology worse for literally no benefit...

[1] https://www.reuters.com/article/us-usa-security-rsa-idUSBRE9...
"bad actor" doesn't mean "bad faith", it's not a value judgement
Chain/web was typo, corrected, thanks.

I know of the key party issues. But there is some value to knowing how far removed from me and people I trust the project authors are.
The author of this is a gentoo maintainer who focuses on security work. Most distros have a couple of point people handling this issue for them at this point, and they are all likely pretty well informed.

If you want clarification on something, you can just ask instead of announcing that you've flagged it.
do you have any evidence for this "dirty little secret"?
Whatever the Prius HSD does is great. It'll do 50 MPG city and highway. No clutch at all.
Totally agree, the options that iOS gives you to attempt to control spam are basically either pathetic or non-existent. I get tons of spam calls from one country, presumably doing a "missed call" scam trying to get me to call back and pay crazy rates. I don't see any reason why implementing a "block everything from country code x" feature would not be completely trivial, and it would instantly solve the problem. Yet my stupid smartphone can't do it.
What can we learn about the backdooring of xz/liblzma, using OpenSSF Scorecards?
They are the apex predators of their particular size (big cats or small cats).
People often confuse luck with persistence.
My initial gut reaction was that the authors were ignoring the obvious solution of simply putting the ring below ground level and setting up maintenance walkways above the ring instead of next to it.

Then I realised the the Earth is spherical and that it doesn’t matter how deep you put this thing, the beam will come out somewhere, even if it needs to go through a thousand kilometres of regolith to get there.

So there could be some random patch of grazing land somewhere in another country that’s dangerous to go near whenever the experiment is running.

PS: I solved the funding problem! Just tell the military about this new unstoppable death ray that can kill anyone even through the planet. [Disclaimer: death will be a decade from now due to cancer. Victim must remain stationary for one year. Construction work is required to retarget beam.]
I don't think that's what they meant. The idea is to find information about their personal life, not OSS contributions. Something that proves they're a real person.
I was wondering if it's somehow theoretically possible there is a link but for some reason we would never be able to observe it.
Being a copycat is how you kickstart your ecosystem. Everything in China was and for the most part is a copycat of western companies.
This is exactly right. AI is a multiplier for the services and data moats that Google already has; the absolute value of generative AI has been greatly overstated. The gold rush (OpenAI) will end and the shovel-sellers (NVIDIA) will hurt too.
Dated June 2022. Good find!
Ah, thanks for correcting me there - really weird that this isn't visible from the profile itself. Not even from the organization.

The following page for each other show both accounts suspended indeed.

https://github.com/Larhzu?tab=following

https://github.com/JiaT75?tab=following
> it appears this is a proxy.

Yes, that IP address appears associated with witopia[.]net, specifically vpn.singapore.witopia[.]net points to that IP address.
The first amendment might overrule the cited law if that law didn't already include a requirement for intentional harm. But since the law does already have that requirement, there's not really an opportunity for a freedom of speech justification to be what protects a non-malicious publication of a proof of concept. The law isn't trying to infringe on freedom of speech.
> It's not like the ORMs exist without SQL.

That's because TINA: There is No Alternative.
I use xpra for similar purposes (https://github.com/Xpra-org/xpra/)

> Xpra is known as "screen for X" : its seamless mode allows you to run X11 programs, usually on a remote host, direct their display to your local machine, and then to disconnect from these programs and reconnect from the same or another machine(s), without losing any state. Effectively giving you remote access to individual graphical applications. It can also be used to access existing desktop sessions and start remote desktop sessions.
Just because a drug is relatively safe doesn't mean it should be allowed if it's inferior to the existing one in all respects.
wow, thanks. I didn't expect to watch the whole thing, but I did.
You also starred in a TV show for the trades right?
Matthias Grünewald's Gruesome Good Friday
My goal here isn't construct some theory I cooked up, my goal is to make you aware of scholarly research that links what is assumed to be old psychedelic driven religion with providing many of the inputs to what became christian lore.
I'm not answering your questions because they are stupid and you are just trying to cause inaction by being overly verbose.

> But first, no one was talking about Apple and Netflix teaming up.

I said Apple instead of Facebook to show how needlessly pedantic you are. There is absolutely no difference between Apple and Facebook here the point is the scale of the company (as I have said)

I wish you to have a needlessly pedantic life and I hope we never cross paths again.
NotAlwaysRight.com has tons of stories about people who ignored signs, closed doors, locked doors etc.