skysight-inc/HackerNews huggingface dataset:
Thanks for clarifying it for me

I think that the argument you're quoting was not so much about how many people would have been infected by this hypothetical patient zero, but that the combined probability of all those events is much smaller than the likelihood of an infected animal transmitting the disease to anyone at the market

That's where the whole discussion about 1/10.000 comes from, since it would require the one person that gets infected to be a worker from the wet market compared to a colleague or a random passer-by at another location

I think that the main point Peter is making is that probability of transmission from racoon dog * cumulative number of people close to racoon dog >> combined probability of those events

If I've misunderstood your point, I'd appreciate if you could point out where I went wrong
'Planting' trees is totally unnecessary.

Leave a patch of land untouched for a few decades and trees will grow up all by themselves.

The real cost is not the seedlings nor the planting, it is the land.
> I'm trying to understand why the characters in Dune fought with swords, pikes and knives.

Because the author wanted a pseudo-medieval setting.

(The shields and the prohibition against computers, nukes etc were just clever plot devices to make advanced weapons unusable).
My agent will call your agent about the movie rights. I think we can safely leave the final twist details to JJ Abrams.

A predestination rewatch has been on my mind for some weeks now, I know how I'll spend the evening :].
That would be for bedrock rather than Java.

Which honestly, would be the one I'd expect an Xbox account compromise to come form as Java edition doesn't really touch xbox/MS accounts outside of the initial launcher using them to check your entitlements for game, multiplayer access (parental controls).

Bedrock however ties much more directly to Xbox et al. due to needing features like joining friends games directly etc.

The only exploit chain I can imagine for Java is compromising the chat report system (which honestly, given the initial implementation they attempted to rush out the door signed *only the message you sent* and *zero context around it*, allowing easy spoofing of context to change the meaning of a message; isn't too far fetched that the backend side of it is similarly scuffed.) and then coercing a ban from the game into a wider account ban.
You're correct about a great many things.
State actors do things in broad-daylight, get exposed, and it's no fuss to them at all.
But that depends on which "sphere of influence" you live in.
Russia and China have made major changes to key parts of their critical infrastructure based on revelations that might only result in a sub-committee in US Congress.

But to establish a significant contributor to a key piece of software, not unlike xz, is an ideal position for a state actor.
The developer doesn't even need to know who/why, but they could be financially/ideologically aligned.
This is what intelligence officers do. They manage real human assets who exist naturally.
But to have someone long-established as an author of a project is the exact type of asset they want. Even if they push the code, people immediately start considering how it could have been done by someone else.
Yes, it's conspiratorial/paranoid thinking but there's nothing more paranoid than state intelligence trade craft.
So, your argument is that MITM/wiretapping is okay if you do it at a large enough scale?
nbdy trusts this guy anymore.
https://web.archive.org/web/20140325225131if_/http://www.wor...
Fragmentation rarely wastes more than 20% memory and 50% is extremely unlikely. But with tracing GC you’re often wasting 4-5x right from the start. Maybe it’s not called fragmentation, but the room needed for the GC to run efficiently is also waste. Plus all the headers in the objects to keep the marking flags also addup.
Reputation works with pseudonymous identities too, and those have security upsides (eg can't be as easily pressed into service of others by extortion or rubber hose). And of course privacy is a value in itself.
NSA, CIA, FBI, DHS.
Also one thing that is easy to come across at this type of work is money. I mean in the cases where someone is injecting backdoors or vulnerabilities. Might not be for individuals or criminal groups. But once agencies and corporations get involved, the sums are trivial...
https://news.ycombinator.com/item?id=39778590
I by default distrust any statement that claims to speak on behalf of some community.
Amazing! Just needs an expert mode with 0-255 and alpha channel
I wonder if the knowledge of Eternal September is also getting e.s. itself
Ever tried Phoenix Slides (open source, long history)? It's definitely faster than Preview for me on large images:

https://blyt.net/phxslides/
> If xz was statically linked in some way, or just used as an executa Le to compress something (like the kernel), the same problems exist and no dynamic linking would need to be involved.

even more so: all binaries dynamically linking xz can be updated by installing a fixed library version. For statically linked binaries: not so much, each individual binary would have to be relinked, good luck with that.
Is Ed448 stronger than Ed25519?
Or they could give Intel only 75% of that for the actual benefits they want.

“More Intel stock” is not in the list of things the government prioritizes. For good reason.

Plus, Intel doesn’t want to be saddled with bureaucratic partners.

Why make a deal more expensive and unattractive to both parties? Better to keep the deal focused on what is actually trying to be achieved.
Baw, GCHQ is going to feel so left out.
The whole XZ drama reminds me of this[1], in another words, verify the identity of open source maintainer/s and question their motive for joining the open source project. Also reminded me of the relevant XKCD meme[2].

Speaking of obfuscation; I'm not a programmer but I did some research in Windows malware RE and what stuck with me is that every code that is obfuscated or every code that is unused is automatically suspicious. There is no purpose for obfuscated code in the open source non-profit software project and there is no purpose for extra code that is unused. Extra/redundant code is most likely junk code meant to confuse the reverse engineer when s/he is debugging the binary.

[1] https://lwn.net/Articles/846272/
[2] https://xkcd.com/2347/
The problem is not only how long the pause takes but also the fact it pauses all the things. In manual memory management even if you have to spend some time in allocation / deallocation, it affects only the allocating thread. A thread that doesn’t allocate doesn’t pause.
After Snowden and stuff like this, I assume if the government (at least federal) really wants it, they can procure it. Plus, the location data is probably saved so it’s just a matter of querying a specific phone number to see the whole history.

https://www.theverge.com/2019/7/16/20696222/att-location-dat...

> The suit stems from recent investigations into how AT&T and other wireless carriers share the sensitive data. A New York Times article last year found that law enforcement has used the data to track phones without a court order. In another investigation, published earlier this year, Motherboard was able to pay a bounty hunter $300 to track the location of a phone using the data. Several lawmakers were quick to criticize the companies’ policies following the Motherboard report.
<https://en.wikipedia.org/w/index.php?title=John_Barnett_(whi...>
Yes, they built a supercomputer called Earth Simulator 20 years ago: https://en.wikipedia.org/wiki/Earth_Simulator
> This is a Linux problem, and the problem is systemd, which is who brought the lib into memory and init'd it.

Not at all, it is a distro issue because a few distros such as Debian chose to patch openssh to bring in systemd support [1].

Other systemd-based distros like Arch Linux remains unaffected because they don't carry this patch.

1: https://sources.debian.org/src/openssh/1%3A9.7p1-2/debian/pa...
After submitting, the background color of the box displaying the match percentage result shows you the color you guessed.

(This may be obvious depending on the color you’re guessing, but in my case the color was quite gray and it took me a few guesses to notice this essential visual aid.)
Relevant to the BTC story is this recent tweet by Bukele: https://twitter.com/nayibbukele/status/1768425845163503738

Looks like they have quite a stack compared to what people previously thought. There's also a tracker you can follow: https://nayibtracker.com
2007 wasn't that long ago, and these type of maintainership issues aren't new – they were a thing when I was starting out in the early 2000s as well. What changed are the stakes, and also the amount of effort bad actors are willing to spend to mine their cryptoblahblah or whatever.

And sure, I understand why people feel a responsibility. And it's fine to take this responsibility too. I'm just saying: there is no need to.

The entire point of this Free Software/Open Source is to give people the freedom to do whatever you want with some piece of software, without having to be beholden to the original author. That's pretty much the entire point.

Anyone in the world can be a maintainer for xz. By forking it and applying useful patches.
I don’t think we know enough to be sure even disabling certificate auth would prevent this. But from what I can tell it probably wouldn’t directly allow arbitrary user login. It only seems to allow the execution of an arbitrary command. But of course that command might do something that would break any other security on the system.

But, one clever thing about this attack is that the commands being run wouldn’t be caught by typical user-login tracking, since there’s no “login”. The attacker is just tricking sshd into running a command.
TBF current photo viewer for Win11 is decent, and cover the basics pretty well.

I reinstalled IrfanView from sheer nostalgia, and while it's still a good program, it doesn't handle pinch/zoom gestures as well as the default app. Same for editing, where IV has more features, yet core stuff like handwriting smoothing isn't as good.

The biggest difference between "these days" and now is IMHO the wide availability of other tools to do more advanced stuff. For instance I remember batch processing features and export features in IV that I used a lot, but nowadays I'd do it in Imagemagick or GIMP.

There is less need for a swiss army knife when the specialized tools are right there any time you need them.
AFAIK the main issue with silicon electronics is not the propagation of electric signals in wire but the switching time of transistors, in such that wait time of computation is 99% inside the transistor and not on the wires between them.
The Curricula
Everything is the best program I have ever used.

I couldn't live without it at this point. It would be like cutting off both arms.
People hate systemd from an ethical, philosophical, and ideological standpoint.
People love systemd for the efficiency, economics, etc.
It's like ideal vs production.
From the inference of the commenter, I think they were referring to an app on a mobile device and not the device itself.

It also sounds like their issue was at the ISP provider level, as well, which takes the business out of the loop of being the data controller/owner (of the collected data) at that point.

Note: I'm not saying that your comment doesn't have merit, I just don't think that the points that you made apply - specifically - in this case?
The idea of PR review is that the submission is imperfect and that there will be fixes. Like, "typo fix" fixes.
Exactly

And a seat on the board retains its fiduciary duty to the company.

It doesn’t allow the government to usurp the company and its resources for its own ends at the expense of other shareholders
Fun! Spill your scores. I can usually get within 85%, had one perfect out of 10. And one 70%
Not really replying to you…

The big difference is that everybody is able to see exactly what has changed recently by comparing old open source code to contemporary open source code.

This makes for a much smaller amount of content that needs to be reviewed by those eyes.
From Nand to Tetris in 12 steps – Google Tech Talks (2007) [video]
I think it would depend on logging level, yeah. I’ve not seen one way or another whether it aborts the login process or prevents logging, but that’s possible, and would obviously be a good idea. Then the question would be if you could detect the difference between a vulnerability-aborted login attempt and just a malformed/interrupted login attempt.

But in the case of this specific attack, probably the safest approach would be to watch and track what processes are being spawned by sshd. Which in retrospect is probably advisable for any network daemon. (Of course, lots of them will be sloppy and messy with how they interact with the system and it might be next to impossible to tell attacks from “legit” behavior. But sshd is probably easier to pin down to what’s “safe” or not.
That's already done, but in this case the attack happened in a glibc ifunc and those run before the patching protection is enabled (since an ifunc has to patch the PLT).
will do that. thank you!
Is it true that Chinese EV's are not sold in the US?

If so, it might not be so obvious to US readers that the Chinese strategy of using the shift to EV's to aggressively chase market share seems to be paying off. In NZ these BYD vehicles are everywhere. The car sharing business in my city seems to be replacing their entire fleet with them.
I did not mean the meaningless idea of "everything depends, I guess," but what I wanted to make was an important and profound distinction.

From a risk perspective, it is highly beneficial to limit the use of Google services to the really important things without which life online is very uncomfortable.

That would probably be identity/Gmail, Play Store access, Pay, and maybe Drive.

For almost all other major risk vectors (especially anything where you would publish content), it is just an obvious and dreadful uncertainty with little data to make a proper case. It's just smart to hedge against Googles all-or-nothing-ban attitude by using a multitude of service providers.

My grandfather digitized all of his family photo negatives (thousands), and wanted to upload them to Google Photos, which would have been an awful idea, given the huge differences in tolerance of nudity between Germany in the 50s to 80s and the US today.

I once bought a device through the Google Store, and Google said they'd send me a box to return my old device. For sending back my old device, Google was going to give me some money (as a discount for buying a new device).

The box never arrived and I asked Google Store support about it twice. I didn't dare ask a third time because, after all, it's Google. It's just not worth $140 to look like someone who might be a scammer, and I felt throughout the conversation that the other side seemed to see it that way. I would have insisted on the return box if I had bought it at Saturn or MediaMarkt, because what would they do if they don't like me? Power matters.
definitely. not talking about the vc specifically, but the investment chain. a typical free rider, directly or indirectly.
The the code parses the files correctly.
> It's not actually unusual for three-letter US agencies to be at odds with one another.

I'd noticed that; this seems to have been the case for a long time. You'd think that having state security agencies at war with one-another would be a disaster, but perhaps it's a feature: a sort of social "layered security". At any rate, it seems much better than having a bunch of state security agencies that all sing from the same songsheet.
Backdoors can be placed in any type of software. For example, a GIMP plugin could connect to your display and read keystrokes, harvest passwords, etcetera. Utilities run by the superuser are of course even more potentially dangerous. Supply-chain attacks like these are just bound to happen. Perhaps not as often in SSH which is heavily scrutinized, but the consequences can be serious nevertheless.
> It's not defeatist to admit and accept that some things are ultimately out of our control.

But that's the thing: deciding how software is built and which features are shipped to users _is_ under our control. The case with xz was exceptionally bad because of the state of the project, but in a well maintained project having these checks and oversight does help with delivering better quality software. I'm not saying that this type of sophisticated attack could've been prevented even if the project was well maintained, but this doesn't mean that there's nothing we can do about it.

> And more importantly, that any attempt to increase control over them comes with downsides.

That's a subjective opinion. I personally find linters and code reviews essential to software development, and if you think of them as being restrictions or useless bureaucratic processes that prevent you from contributing to a project then you're entitled to your opinion, but I disagree. The downsides you mention are simply minimum contribution requirements, and not having any at all would ultimately become a burden on everybody, lead to a chaotic SDLC, and to more issues being shipped to users. I don't have any empirical evidence to back this up, so this is also "just" my opinion based on working on projects with well-defined guidelines.

I'm sure you would agree with the Optimistic Merging methodology[1]. I'd be curious to know whether this has any tangible benefits as claimed by its proponents. At first glance, a project like https://github.com/zeromq/libzmq doesn't appear to have a more vibrant community than a project of comparable size and popularity like https://github.com/NixOS/nix, while the latter uses the criticized "Pessimistic Merging" methodology. Perhaps I'm looking at the wrong signals, but I'm not able to see a clear advantage of OM, while I can see clear disadvantages of it.

libzmq does have contribution guidelines[2], but a code review process is unspecified (even though it mentions having "systematic reviews"), and there are no testing requirements besides patches being required to "pass project self-tests". Who conducts reviews and when, or who works on tests is entirely unclear, though the project seems to have 75% coverage, so someone must be doing this. I'm not sure whether all of this makes contributors happier, but I sure wouldn't like to work on a project where this is unclear.

> Without people willing to contribute their time, open source cannot function.

Agreed, but I would argue that no project, open source or otherwise, can function without contribution guidelines that maintain certain quality standards.

[1]: https://news.ycombinator.com/item?id=39880972

[2]: https://rfc.zeromq.org/spec/42/
> The SaaS/cloud/etc. companies themselves should fund the projects they depend on.

If anything, the same "valuable" "community" members, a lot of which includes such SaaS businesses and other freeloaders, seems to shout at projects trying to ensure their survival through formal ownership structures and license changes.
Also remember the times... I think ACDsee 2.3.x was a game changer on Windows systems with little memory back in the day... it was so fast and displayed partially on the fly.

Btw I use a Mac nowadays and I get strong ACDsee vibes from open-source Phoenix Slides https://blyt.net/phxslides/ with browsing through images with the mouse-wheel ;)
As my partner is pretty much from that area, I really appreciate this small excursion from the typical topics on HN. Especially the small things, like the foods and the palinka :)
Because a sudden influx of new users tends to change the culture of an existig community. People don't like that. I know I was shunned for making low effort comments when first arriving here from Reddit, and in retrospect I'm glad that I wasn't coddled, I wasn't made to feel welcome, I had to learn the rules and now this is my favorite corner of the internet, because HN changed me, not the other way around.
No. <https://geekfeminism.fandom.com/wiki/Who_is_harmed_by_a_%22R...>
Can I ask for why it wouldn't have been discovered if the obvious delay wasn't present? Wouldn't anyone profiling a running sshd (which I have to imagine someone out there is doing) see it spending all its crypto time in liblzma?
SSH client is not for non tech users and I tried to keep my list non tech oriented, something you can install on yours, your mom or Janice from accounting and they will all benefit from it.

For SSH I was a die hard team PuTTy for a long time but these days one of the first thing I install on my windows computer is WSL and a Debian inside, that covers all my SSH needs.
The "stuff behind the door" is conveniently uploaded with the secret knock. It's not there and it will never be because it's remotely executed without getting written down. The attacker does send executable code, singed and encrypted (or only one of them? It does not matter) with their private key. The door checks anything incoming for a match with the public key it has and executes when happy.

C++ has nothing to do with this, it's the dynamic linking mechanism that allows trusted code the things it allows trusted code to do (talking about the hooking that makes the key check possible, not about the execution that comes after - that is even more mundane, code can execute code, it's a von Neumann architecture after all).
J'Accuse! On the Cancelled Monkey Island Movie and Pirates of the Caribbean
any competent malware dev would have a panic switch...
Sad news! It's a total BS.

The reputable press for some reason spread fake news about the fact that the Sagrada Familia is supposed to be finally completed by 2026.

This is complete nonsense, I can't understand how it happened. Apparently, one person stepped in and everyone else happily picked up on it.

In fact, by 2026 it is planned to complete only the central bell tower, the Jesus Tower, which will make the temple the tallest in the world, and the corner Chapel of the Ascension. After that, there will remain such a "small, insignificant detail" as the construction of the central facade of the basilica. It is planned to work on it until 2034 (if everything goes according to plan, the builders cunningly add in this place).

And, only then will the discussion be started about the construction of the stair bridge leading to the entrance, which requires demolishing a block of living buildings on Mallorca Street, imagine the friction at this point..

So, no, it's not going to be finished in 2026. But that doesn't make it a penny less marvelous, one wouldn't even notice it's not finished.
I’ve been using aiosql and Hugsql for years and have never had any problems. In fact, Hugsql has a “snippets” feature that allows you to compose bits of SQL dynamically.

https://www.hugsql.org/using-hugsql/composability/snippets

But the vast majority of SQL I’ve worked with simply doesn’t need it. But even when you do, the situation has never been any worse than it is with ORM’s for me.
The unreasonable effectiveness of VMs in hacker pedagogy
>>> Software developers are not fungible cogs that you can swap in and out at will.

I am thinking a lot about this. One of the issues is scale and proof. I suspect that I am interested in introducing gated ability to comment / participate in a community

Say for example github introduces “gates”. The first might be add a test to the test suite that generates a haha of the version number and test output. Then adding that number to your profile means github trusts you have at least downloaded and run make test. It shows some level of commitment. (I suppose the zero level is logging in to github and commenting on some maintainers mental health)
The compiler will almost always do the bit shifting, and better for you. Just switch python with rust and you’ll get both performance and safe code
I used Gwenview back in the days in Linux. I think it's still great.