skysight-inc/HackerNews huggingface dataset:
Apple Time Capsule used to run on NetBSD as well.

Unfortunately TrueNAS will move to Linux. At least TrueNAS Scale, based on Linux which going forward will be what they are focusing on.

The land of FreeBSD or BSDs are rapidly shrinking.
About Xz: "A Microcosm of the interactions in Open Source projects"
Hmm, good perspective.

But doesn’t this seem to be a no true Scotsman fallacy? If you call all failed democracies not real democracies, you can write them off and only focus on the successful ones.

Does a corrupt and poor democracy ceases to be a democracy?

I agree that democracy is the best system when implemented well. I’m just pointing out that many countries have struggled to succeed as democracies because they lack the proper mindset and culture of maintaining one.
That's appalling to say at least. But Snapchat implemented certificate-pinning since 2015. Does that mean either the analytics endpoint was not covered or somehow the certificate-pinning is circumvented in this case?
Using a jump host could help, only allowing port forwarding. Ideally it would be heavily monitored and create a new instance for every connection (e.g., inside a container).

The attacker would then be stuck inside the jump host and would have to probe where to connect next. This hopefully would then trigger an alert, causing some suspicion.

A shared instance would allow the attacker to just wait for another connection and then follow its traces, without risking triggering an alert by probing.

The ideal jump host would allow to freeze the running ssh process on an alert, either with a snapshot (VM based) or checkpointing (container based), so it can be analyzed later.
I’m highly safety critical systems you have software (and hardware) diversity were multiple pieces of software, developed independently, have to vote on the result. Maybe highly critical pieces of Linux like the login process should be designed the same way. So that two binaries without common dependencies would need to accept the login for the user to get privileges.

Exactly how to do it (especially transparently for the user), I have no idea though. Maybe sending ssh login requests to two different sshd implementations and if they don’t do the same things (same system calls), they are both killed.

Or some kind of two step login process where the first login only gives access to the sandbox of the second login process.

But in general I assume the Linux attack surface is too big to do software diversity for all of it.
Read a related story about using vertical farming to 'mass produce' seeds and saplings:

https://ahealthierearth.com/news/blenheim-estate-announces-p...
Because "feeling threatened" is not what this is about, so your point is meaningless. It's dishonest to make up stuff.
Just one layout? Lame.
You’re greatly misinformed. Russia and Belarus are tons safer than your average American or Western European city.
The metagame of life is to figure out what our own personal metagames are.
My experience traveling in Colombia was that they are generally quite down on it because of the harm they see the illegal drug trade has done to their country.

It's the worst kind of resource curse.
Maybe their organisation has a policy that requires stronger encryption? Possibly because that organisation is also in the business of cracking such encryption...
There is virtually no intelligent discourse on Reddit left. It is a very angsty, hostile place veiled in a thick layer of fake virtue.

Unfortunately many of internets town halls are going the same way.

10 years ago I thought the solution to the declining positive discourse on the internet was profiles attached to real names, real photos. Then twitter proved me wrong.
The second thing I noticed was the comments and posts per day cratering recently. Is that real?
catch 22 - if the housing market drops significantly, the country will be very close to going bankrupt, so all they can do is let air out as slowly as humanly possible.

A full on crash would be ugly. No matter what part of society you live in (well maybe except the 0.1%).

Labour did a pump and dump on immigration to make the books look a (tiny) bit better). National well, yes..
> surely a decent password (long, random, etc) is for all practical purposes unguessable

Sadly that is not how normies use passwords. WE know what passwords managers are for. Vast majority of people outside our confined sphere do not.

In short: password rotation policies make passwords overall less secure, because in order to remember what the new password is, people apply patterns. Patterns are guessable. Patterns get applied to future password as well. This has been known to the infosec people since 1990's because they had to understand how people actually behave. It took a research paper[0], published in 2010, to finally provide sufficient data for that fact to become undeniable.

It still took another 6-7 years until the information percolated through to the relevant regulatory bodies and for them to update their previous guidance. These days both NIST and NCSC tell in very clear terms to not require password rotation.

0: https://www.researchgate.net/publication/221517955_The_true_...
Like in this article, we have a patch that introduces a security flaw (disabling landlock). We later have a patch that fixes it, specifically. The job of the LLM is to reproduce the fixing patch given the problem patch. Or at the very least, explain that this patch results in landlock always being disabled. To be clear, this problem is much, much harder than the problems LLMs are solving now, requiring knowledge of autotools behavior that isn’t included in the context (identifying that a failed build disables the feature, and that this build always fails).

There was another example where this team submitted a patch that swapped safe_fprintf for fprintf while adding some additional behavior. It was later pointed out that this allows printing invisible characters to the stream, which allows hiding some of the files that are placed when decompressing.
Yeah, this whole thread is weird and filled with angry rants against something no one has said.

It's quite ironic that removing a picture for the sake of inclusitivity raises this kind of responses. I wonder how many here are also making their woman coworkers uncomfortable every day, given their apparent lack of empathy and dismissal of their feelings.
The point still stands that this is an inherit possibility in the language it self.
Why do you care so much about their faults? How do you know those are really faults, maybe it's just your own perception?
> analytics endpoint was not covered

This sounds most likely
Color lasers are much more expensive than color Inkjets. Much more.

And many Inkjets are print+copy+scan. To get the same with laser ones, you will have to shell out 3x-4x.
Looking at IFUNC, there never seems to be a reason to allow function loading from a different library than the one the call is in, right? Maybe a restriction like that could be built in. Or just explicitly enumerate the possible substitutions per site.
HN pro tip - scroll down past the k8s bashing to get to the real stuff. Thank you!
water is at least a priced commodity. and yes if an industrial use robs a town of clean water, the courts and/or government need to be involved.
It's pretty impossible to lock down sshd. The restrictions are inherited by all ancestors. What would the sysadmin say if they find themselves in a restricted shell?
No one needs Adobe to stay alive.
Satosa: Proxy translating between different authentication protocols
Lol the irony of publicly announcing the addition of end-to-end encryption in one app (Whatsapp) while secretly breaking TLS in another, all in the same year #Tethics
> There might be a middle point between everybody voting and one person voting that would be more optimal.

That’s called an dictatorship. Absolute unquestionable authority is a myth, even Stalin relied on the support of others to stay in power and had to make decisions while keeping that in mind. Most other dictators in history didn’t even remotely have as much power as him.
Yes and no. We have a lot of temp workers (students/under 30's) who come for the adventure, get sick of living in a van and going home again after their working holiday is done.

Some other people are willing to justify it (eg coming from the bay area). But I think the reality once they get here is different - about 3-4 years ago I was running a software co that was recruiting a bit of overseas people for the skills we needed, we started to get a few that would leave the country after they realised 'maybe the grass isn't greener'
I was happy with my restic, borg (vorta), and tarsnap backup setup until one day I had to retrieve just one file from the backups and I realised there was no straight forward way to do that in any of these. Now I think I must look for backup which lets be “easily” get my files back and search whether something is there by a certain approximate name among my backups without having me deal with mounts (that too one version at a time) and often fail. It would be nice to just know that file/dir “abc xyz” or with similar names were backed up in snapshots m, n,…, z. Then I can just fetch the version I want.
Certainly nobody chooses to live there for the tourists!

And it’s a fine place; I’ve just driven Seattle-LA on every path imaginable more times than I can count. It happens to be right around the point where you’re really far from absolutely everything, and it all looks the same.
So, the FANGs can conduct mass psyops warfare against the populace basically with impunity -- a pesky little suit now and then is inconsequential.

But what will happen when they get caught stealing each other's surveillance booty?
C basically has no standard library. It's no surprise to anyone who has ever used it more than in passing that you depend on the chosen build system to replace that. Building portable C libraries is very different because of this from any other commonly used programming language - even C++.
Gross negligence and willfull misconduct cannot be waved away like this, in certain legislations, at least.
This isn't a problem of just building vs meetings; it's the entire package of a company run by human beings.

There needs to be a certain amount of communication between the different "organs" of a company in order for it to run efficiently and effectively. With 2-3 people, it's easy: Just go up and talk to the person. Up to 10 people it's still pretty easy, although you now need some coordination to make sure you're not stomping over each other's stuff.

At 20-30 people, you can't get anything done without team leads/managers. And this management layer would then handle most of the day-to-day while pushing important information to the exec layer (likely 1-3 people).

Getting up to 50 people and now you need to expand the exec layer to cover finance, marketing, production, legal, mission, etc. You'll also have managers handling multiple teams, each with a team lead.

Up to 100 people and now you probably have two layers of middle management just to keep the information flow and coordination at human scale.

It's a lot like the elevator conundrum ( https://elevation.fandom.com/wiki/Elevator_conundrum ): The taller you build a building, the more space is needed by elevator shafts in order to get people efficiently between floors. There are tricks that allow you to use the elevators more efficiently, but eventually you hit a maximum. People don't like the elevator shafts taking up valuable space, but you also can't have an efficient building without them.

And the bigger your organization becomes, the more of these management and policy "elevator shafts" you need. And then your organization just starts to slow down. Innovation stagnates because it takes so damn long for an idea to make its way through the organization, get all the sign-offs, get funding etc. It's why Google can't innovate anymore, despite their attempts to bake innovation into their DNA. A quick visit to https://gcemetery.co/ is enough to show what that "innovation" policy accomplished, and demonstrates that this isn't a culture problem, but rather a human scaling problem.

And it's even worse with human scaling, because unlike elevator shafts, humans aren't cogs built to specifications. We also have to handle the chaos of different personalities and traits and skill levels in various things that contribute or detract from harmony IN THAT PARTICULAR ORGANIZATION (that's right: one org's success story can't just be transplanted to another).

So yeah, you're not just dealing with production and documentation and meetings; you're dealing with the whole package. And your solutions will have to take that whole package into account. And you'll have to keep revisiting it as your organization grows.
I use maccy on my wife’s Mac and don’t love it, maybe it’s bec I’m still not comfortable with Mac keyboard shortcuts or maybe it’s just the UI, but there’s something about it that feels less baked than ditto.
...with the consent of the users who installed this.

Some recent related discussion: https://news.ycombinator.com/item?id=39860486
I love all the people who said "Oh, no, generative AI will flood the online world with crap", as if generative natural intelligence hadn't already done so: https://en.wikipedia.org/wiki/Sturgeon%27s_law

(periodic reminder: https://search.marginalia.nu )
This is my list, but it’s pretty opinionated and is missing some pieces: Backblaze Backupper, Canon CaptureOnTouch, YNAB CLassic, and GPSoft’s Directory Opus

https://gist.github.com/Christoph-Wagner/c26ee84105edd12b4d3...
BYD Rolls Off Its 7Mth New Energy Vehicle
Yeah, I used to be very adverse to such things, I still am, in part because I know just how impossible it is to read something you dont believe and get an understanding of the material at the same time. It requires suspension of disbelief. anyone can have an open mind sometimes, but no one can do that all the time. For some concrete examples I would implore you to read excerpts from 'Ageless Body, Timeless Mind' by deepak chopra. To put it mildly, I know I have my limits.

Required reading material is usually more mundane than some of the stuff out there. But that could also mean that it's not daring enough to require reading. So my philosophy is that you should support people in choosing their adversity, never mandating.
Yes, but hopefully it does protect Lasse Collin.
No they don't. The issue with dictatorships is that your powerbase rurns from "the people" (or a wealthy subset of the people, depending on how well your democracy works), to a small group of powerfull supporters. Army generals, police chiefs and so on. Even if you were an angel, the power dynamics of dictatorships don't give you the ability of doing all too much for the general populace.
Thats the beuaty of democracy. Your power base is (indirectly and delayed, but still) the people. This aligns incentives and power dynamics between power holders and regular inhabitants much more than in any kind of autocracy.
> You never submit your password, you submit that hash and they compare it.

That's not true. If that were the case, the hash is now the password and the server stores it in clear text. It defeats the entire purpose of hashing passwords.

Side note: that is (almost) how NTLM authentication works and why pass-the-hash is a thing in Windows networks.
> They'd effectively have a skeleton key that only they could use (or sell) that

this looks more like state sponsored attack and it doesn't look like someone joining and at one point realizing they want to implement this backdoor.

The guy joined the project 2 years ago, developed a test framework (which he then used to hide binary of the backdoor in which appears that is complex and others are still figuring out how it works) then he gradually disabled various security checks before activating it.
How out of touch are you. Offense to you.

Bureaucrats can't do anything. They just try to stop innovation.

EU is just hurting its own startups.

USA, India, China. They all have multibillion AI companies. EU doesn't because nobody wants to deal with unpredictable lawmakers

https://www.euronews.com/next/2024/03/16/eu-ai-act-reaction-...
If it was not fulltime work I wonder what else they have been working on with different accounts.
I use it together with VS code and rust-analyser. I like having a view of the entire project - if I break something in a file I don't have open in the editor it is more obvious in the bacon output. You can also switch it to test mode.

However compared to cargo watch -c -x {check,test} it is only marginal improvement.
> cannot print out the string "ABC"

When you write a program in any modern programming language to print "ABC",
that program merely outputs the 3 bytes 01000001 01000010 01000011,
ASCII codes which your console window (not the program you wrote) decides to display graphically as those characters.

So any machine outputting bits can be said to print out "ABC" just as well.

Furthermore, your comment above was transmitted by your browser to Hacker News not as English characters but as those very bits, and everyone reading your comment was receiving those bits. The way that the browser decides to display those bits does not change their character.
That assumes the maintainer wants to be paid. There are plenty of us who maintain FLOSS projects that do it for other reasons and any monetary exchange would burden us, since it might pressure one that this is now a job and you have to execute on tasks - there are enough headaches handling other things as it is.
I've been on the receiving end of "thoughtful" rejection letters. Some have been helpful, but some really served to cement the subjectivity of the whole thing.

The "funniest" one is one where I in fact knew the person who got the job. I received a nice and long rejection letter explaining all the points they found off for me. I was too aloof during the interview process itself (thinking I was a good fit), and many of the points mentioned were not wrong. But I knew for a fact that I was better than the person who got the job on all the mentioned points[0]! There was one thing not mentioned, a pure "culture fit" component[1]. Pretty sure that was a decisive factor, but not mentioned.

It just felt like something where, if I didn't have the full context, I would have really bogged myself down from "wrong" feedback. And when feedback can involve innate parts of one's personality, from people who have already decided to not work with you, it can be painful.

[0]: I worked closely with this person for many years. I do not have ill will towards them, the skill gap I'm mentioning was purely a "years of experience" thing IMO

[1]: for the curious: the place hired loads of people in a certain community, of which ~all of them were from the British Isles. I am not.
I would suggest that a lot of the negative feelings you may be having come from being in a failing startup.

The problem you have in a failing startup is you don’t have any scope for bringing in help for yourself. Can you hire a VPEng or Head of Engineering to take on a lot of the day to day management and delivery responsibilities? You can move yourself into a much more technical/R&D role.

Another thing to remember is that “CTO” can encompass many different things depending on the size of a company.

Very small early stage startups - the CTO is generally the most prolific IC. It may be that this the sweet spot for you.

Businesses often require different CTOs for different stages and there’s nothing wrong with being a particular type of CTO. You can say - “the role has evolved and I’m no longer the right person”. Or “my strengths are in these areas, I need people to fill in these gaps”.
My suggestion: Put your SSH behind WireGuard and/or behind a jump host (with only port forwarding allowed, no shell). If you don’t have a separate host, use a Docker container.

If you use a jump host, consider a different OS (e.g., BSD vs Linux). Remember this analogy with slices of Swiss cheese used during the pandemics? If one slice has a hole, the next slice hopefully won’t have a hole on the same position. The more slices you have, the better for you.

Although for remote management, you don’t want to have too many “slices” you have to manage and that can fail.
Interesting. With older music, it’s kinda expected, as (especially church) songs often have "to the melody of" parts. Just did not think it would be the same for contemporary.
Reminded me of the 19th century Russian circular ironclads:

https://en.wikipedia.org/wiki/Russian_monitor_Novgorod
Only when they used Onavo, it seems?

https://en.wikipedia.org/wiki/Onavo is slightly more readable than the legal document submitted as the link.
You should read up on the attack. The few characters were part of avoiding a specific case of detection. The back door is very large, is only added during tar build, and happens to only work when a special key is presented.
Better-still is `git commit --fixup {rev}` and `git rebase -i --autosquash`, since then the fix(up) can be placed into the most-appropriate commit, which isn't necessarily the most-recent one.

Of course, that assumes a you're already got a workforce that is able to do resolve minor conflicts when something else near the typo got tweaked in a separate commit, so I'll grant that `--amend` is easier when starting out.
People feel like this about a lot of Nobel authors. Patrick White won, I've never finished any book of his after "a fringe of leaves" and Thomas Mann just bored me to tears. To the other side, the ones i loved, Hermann Hesse was un-putdownable. Likewise Doris Lessing. A lot of people dislike Lessings writing style.

So.. it's all about what you like.

But I'd take writing advice from Ms Morrison seriously.
I have a website with a game download that has maybe 50 players total. Nobody uses it. I'm fairly certain that actual people downloading the game is maybe a few per month. Yet from this 2GB zip file I've had 5TB traffic over the last month and this has been going on for years.

This is no "DDOS", it's just misconfigured bots/crawlers going through all the links and being unable to cancel downloads.
> I never understood why clients are coded this way.

Because it makes things less secure. If it was sufficient to send the hash to the server to authenticate, and the server simply compares the hash sent by the user with the hash in its database, then the hash as actually the password. An attacker doesn't need to know the password anymore, as the hash is sufficient.

Hashing was introduced precisely because some vulnerabilities allow read access to the database. With hashed passwords, the attacker in such a situation has to perform a password guessing attack first to proceed. If it was sufficient to send the hash for authentication, the attacker would not need to guess anything.
I might be wrong but I think you need the onavo VPN installed

Then your YouTube, Snapchat analytics would get man in the middled
Not an AI expert of Pro AI fans. IMO I do think it isn't about what AI or LLM could do now, but their trajectory into the future. Especially when a model is specifically trained for that certain job.

It wont completely replace human, but even if they are only good enough for 20-30% of it ( or even 10-20% for argument sake ), it is not hard to see they could be ~80% in ~5 to 10 years time. And that is scary.
So for all practical purposes you can't sandbox ssh on a developer's machine much.
Real nurses do a 1000x more things than give advice. Not sure if you've ever stayed in hospital, but man, what a job these people do.
Check out NGOs doing related things, e.g. https://www.rainforestcoalition.org/ which tries to raise money to protect rainforests.
Optional features should not depend on feature detection, ever. Feature detection for a security feature should be suspicious, even if it works as intended.

Optional features should always be configured by whoever tries to compile the code. There can be defaults, but they shouldn't depend on the environment.