skysight-inc/HackerNews huggingface dataset:
Likely part of what the attacker(s) are counting on. Anyone want to place odds this isn't the only thing that's going to be found?
We shouldn't rule it out, but it seems unlikely to me.

This is more reckless than any backdoor I can think of by a US agency . NSA backdoored Dual EC DRBG, which was extremely reckless, but this makes that look careful and that was the Zenith of NSA recklessness. The attackers here straight up just cowboy'd the joint. I can't think of any instance in which US intelligence used sock puppets on public forums and mailinglists to encourage deployment of the backdoored software and I maintain a list of NSA backdoors: https://www.ethanheilman.com/x/12/index.html

It just doesn't seem like their style.
Your being able to reflect upon it and analyze your own reaction is rare, valuable and appreciated
I'm not an expert in this, but...

> BNNs bring the following advantages over GPs: First, training large GPs is computationally expensive, and traditional training algorithms scale as the cube of the number of data points in the time series. In contrast, for a fixed width, training a BNN will often be approximately linear in the number of data points. Second, BNNs lend themselves better to GPU and TPU hardware acceleration than GP training operations.

If I'm not mistaken Hilbert Space Gaussian Processes (HSGPs) are O(mn+m) (where m is the number of basis functions, often something like m=30, m=60, or m=100), which is also a huge improvement over conventional GPs' O(n^3). I know that there are some constraints on HSGPs (e.g. they work best with stationary time series, and they're not quite as accurate, flexible, or readily interpretable or tunable as conventional GPs), but what would be the argument for an AutoBNN over an HSGP? Is it mainly about the lack of a need for domain expert input?
I’ve had them call me the complete wrong name before as well. Not even a merged family member, they basically texted the wrong number.
nice work but why code is in closures using ugly `var` statement?
Functional Source License (FSL) is a good alternative, it automatically converts the released source code to to Apache 2.0 or MIT after two years. It's simple, provides a reasonable way for SaaS companies to function with source available and works automatically, so if the company goes under the users/community are not left with nothing.

https://fsl.software/
Sure, there are improvements, but it's not like Postgres was a radically different beast back then.

Would I pick Postgres 15 over Postgres 8? Yes, any day of the week. But I would also readily pick Postgres 8 over most of today's databases (including e.g. the latest MySQL and MongoDB versions), for most projects, if that was the choice I had.
It can be the whole story.

Engineering organizations fall in love with superficial attributes of solutions that worked especially well for them in the past. When RIM/BlackBerry realized the iPhone was a serious threat, they built a touchscreen phone where the entire display produces a physical clicking effect because they were so convinced that what people really want from a smartphone is the click of a keyboard.

Mazda is BlackBerry, and the rotary engine is their clicky keyboard.
I'm not trying to troll, but I'm wondering if a distro like Gentoo is less susceptible to such attacks, since the source code feels more transparent with their approach. But then again, it seems that upstream was infected in this case, so I'm not sure if a culture of compiling from source locally would help.
What about the time it was shown they did the reverse (hardened security using math only they knew at the time) for DSA
The time stamp of a git commit depends on the system clock of the computer the commit was checked in. This cannot be checked by github & co (except that they could reject commits which have time stamps in the future).
I'm sorry, but as evidenced by literally the rest of the world, voting wait times are not a research-level mathematics problem, but purely one of resources. Census data and a tiny bit of queuing theory (or alternatively, historical data) will tell you the peak load of a voting booth. Staff accordingly, problem solved.
The LHC has been doing lead-lead collisions (occasionally) for a few years now. How much more energetic would this smaller muon reactor be?
Authoritarianism is such a bummer. You can never have nice things without big bro shoving its filthy hands in it. So sad that humans are still doing this as we are entering the age of AI.
Ok, but what does a perceptron look like in 1-bit? Would it be just some simple logic gate, like an OR-gate?
Want to comment explicitly, though I upvoted a similar comment ... a gas turbine in a consumer car will be a maintainability nightmare (where do you find the technicians that can do anything with it?), at least in the current automotive ecosystem.
The whole reason that I had keys to enable/disable the alarm was specifically because the Outdoor Program that I worked at needed to load in/out large equipment (think canoes, bikes, sleds, etc) that was ungainly to move through the locker room. This was also the primary avenue for moving e.g. weight room equipment in and out of the facility. So while it didn't get used a lot for non-emergency use, it got used often enough that non-durable controls would degrade much too quickly.
Google is so lost.
Consciousness is really just useful for guarding gradients of entropy. There's some serious gradients of entropy inside the Sun and we don't know what kind of self-influencing processes might appear.

Let's imagine that there's some kind of competition between self-regulating magneto hydrodynamic processes inside the sun.

Well, eventually an overarching consciousness arises, controlling all of the degrees of freedom that it can and evolving into a mind that can perceive the rest of the universe.

The original survival context may have been persistently recurring structures in solar convection cells, but now the being is far beyond worrying about such little matters.

It is free to probe the minds of other beings, and perhaps to perceive the rest of the universe. Perhaps it is curious and peaceful. Perhaps it is paranoid and violent, ready to fight against other star beings, ready to kill us if we ever try to do stellar level engineering.

I bet it fears nothing and just exists, since it's so far outside of the survival context that it evolved for, and has no reason to care if it lives or dies.
I think none of these issues really matter.

Sure, it isn't perfect. But all of those issues are liveable-with. Most of them involve handling corrupt data - but any serious archive will hash the whole file as part of the cataloging process.

The commonly-used technology is by far the best choice for long term archiving, because something that has a billion users will go obsolete/unreadable a long time after a fancy compressor written by a phd student in your lab.

If I were running an archive today, I would be keeping everything in .zip files, because there is a ~35 year window of computers that can open them, and I wouldn't be surprised if the format remains in common use for a further 35 years. That means that in the year 3000, someone wanting to access the data only needs to find/emulate a system from anytime between 1990 and 2060 to have a good chance of reading the data.
Interesting, thanks.

>That said… it turns out 37 crops up as a prime factor of 111, 111111, 111111111, 111111111111… so there’s something a little more going on here…

There sure is. Paging Ramanujan ... :)

https://en.m.wikipedia.org/wiki/Srinivasa_Ramanujan
Yeah if you tried to revert stuff that was
done weeks ago on a relatively small team you know how much painstaking work it can be.
github already suspended the account
Yes, they are parallel hybrids.
Dynamic ecosystems need predators, but this isn't an argument in favor of letting pets roam outdoors - it's an argument in favor of not hunting, trapping or otherwise killing foxes, true wild cats, and coyotes. Moving up the ladder into mountain lions, wolves and grizzly bears does fill people with rising alarm (while there is an active movement to protect mountain lions and re-introduce wolves to California, I have yet to see any 'bring back the Grizzly' proposals, even though it's on the state flag - and mountain lions are enough to keep deer populations in check).

From an ecosystem perspective, cats are very successful hunters (the record for % of hunts that end in success is held by a small African wild cat^), but if there's a healthy coyote population in the vicinity, feral cats quickly become scarce (as do any overly fat squirrels).

^ https://youtu.be/nl8o9PsJPAQ

Crows and ravens predate on baby birds and nestlings, but again this is a dynamic ecosystem norm. A backyard birdfeeder for songbirds tends to draw bird-hunting hawks too, which is fine, they're incredibly acrobatic and watching them hunt is quite the show - plus, natural (unsubsidized) predation removes the chaff from the wheat, improving the songbird population genetics. Young hawks in turn may be hunted by owls.

That's nature for you - and an argument for not letting pets roam outdoors unsupervised. Additionally, letting cats eat wild animals tends to lead to internal parasites, fleas, viruses etc.
And AFAIK the only part of Xorg where development happens in the recent years.
Looking to build a personalized AI for myself. Any resources?
Hey, I'm looking to create a personalized AI for myself in the context of me in an online community. I spend a lot of time in an online community, and I'd like to have a personalized AI to help me with communicating there. I want to have the AI know all the members there and give me ideas for conversation topics.

I know I could probably do this with ChatGPT, but I'm wondering if there's a specific solution built for this.

Thanks!
Many of these, however, should just be doors. For many of them the alarming of them seems unnecessary.
Rolling back two years worth of commits made by a major contributor is going to be hell. I'm looking forward to see how they'll do this.
What does Apple Music do better than Spotify in the music space?
Mine certainly doesn’t.
Campaigns are very data driven these days. I assume they're AB testing everything and it's working to maximize donations, but it's definitely been a turn off for me.

I also dislike the hyperbole in the messages. It's not "Hi, I'm Adam running for xyz position", but "My opponent is trying to destroy the country! Donate now to save America!"
seems trivial for a configure script to call curl/wget somewhere in the depths of it, no?
They were pulling a tarball from upstream and building it - the tarball was compromised.
Yes, but it is the privilege of the people who pioneer a new human endeavor to name things and pick its arbitrary standards and inform those choices with their beliefs. I would prefer people simply register their disagreement if the issue comes up instead of seeking out trivial historical artifacts of previous social norms.
They're definitely a real person. I know cause that "1Password employee since December" is a person I know IRL and worked with for years at their prior employer. They're not a no-name person or a fake identity just FYI. Please don't be witch hunting; this genuinely looks like an unfortunate case where Jared was merely proactively doing their job by trying to get an externally maintained golang bindings of XZ to the latest version of XZ. Jared's pretty fantastic to work with and is definitely the type of person to be filing PRs on external tools to get them to update dependencies. I think the timing is comically bad, but I can vouch for Jared.

https://github.com/jamespfennell/xz/pull/2
Not quite - if you do care, you can fork. I wouldn’t host as a third party service so it wouldn’t affect my projects either way.
You mean this?

> I think that my favorite, in a way, is the assertion that when sodium benzoate is exposed to ascorbic acid, that it immediately converts to benzene, which cues up a look at benzene's (most definitely alarming) toxicity. The source for this would have to be this paper from 2008, which analyzed a long list of beverages for benzene contamination, and found that the only detectable levels were in carrot juice intended for infants.

That's the whole "take". Looks like your guy's snark is rather poorly informed...

https://en.wikipedia.org/wiki/Benzene_in_soft_drinks

Funny how a study from 2008 didn't find much, isn't it?

> These usernames confuse me

I was confused too... then decided to share the confusion :D
> Mazda is BlackBerry

No, they're not. Go test drive a Miata. They make the most fun cars to come out of Japan. And also have one of the better design languages.
Already happening? Here's a clip from an astroturfing firm in the year 2000 for Sprite and other clients. They called it 'under the radar marketing' back then. I'd wager 95% of all product recommendations on Reddit, and HN for that matter, are placed by people with agendas.

[0] https://www.youtube.com/watch?v=F0z0a4SLIsM
This was your comment that I was replying to, with emphasis added:

> I think the argument is that states are not laboratories for behaviors that violate the constitutional rights of others, or in the case of this law, go beyond the legislative branch's constitutional powers, so that just suggesting there isn't an experiment is in itself not sufficient to defend this law.

This comment implies that your objection to the law was not that it infringed upon constitutional rights, but rather that it exceeded the powers of Florida legislature. This was the point I was replying to. If that’s not the point you intended to make, then never mind.
For 1 bit math, at least it should be possible to populate every other bit of an integer type, right? Surely one could do better with a dedicated type for this, but at least we could pack 16 single-bit weights into a 32 bit int for addition, right?
There is also a variety of new, parallelized implementations of compression algorithms which would be good to have a close look at. Bugs causing undefined behaviour in parallel code are notoriously hard to see, and the parallel versions (which are actually much faster) could be take the place of well-established programs which have earned a lot of trust.
I guess that rewriting liblzma in Rust would not have prevented this backdoor. But would have likely increased the confidence in its safety.

Using the build system (and potentially the compiler) to insert malicious backdoors is far from a new idea, and I don't see why this example would the only case.
Red Hat helps to do the job of making sure OSS has CVEs so there's common vernacular for the problem.
How about wheels in the python ecosystem
Yeah basically. In binary, multiplication is an XNOR operation.

00 = 1

01 = 0

10 = 0

11 = 1
The code that runs during testing should not be allowed to affect the package though. If this is possible, this is misdesigned.
depends on whether you feel like you have the leverage to do something about it, or if all that happens now is you do the same job with the same pay and the additional knowledge that someone else is making more.
It's probably not as difficult as you'd think. Embedded X servers have existed for a long time (that is, running an X server as a client of another X server), and running them rootless (without displaying a "desktop" of their own) is also nothing new.

From there it's just a matter of writing the code to allow it to be a wayland client, which isn't that hard, and then doing translation between the wayland event callbacks and X events.

That will at least get you something basic working. There's a bit more to it, of course, and those details are why it's still actively maintained and worked on, but it's not too crazy.

The wayland compositor itself does need to special-case Xwayland, which brings some complexity.
In other words, they're trying to keep the variance of the distribution of salaries constant over time.

Limiting economic disparity have always been beneficial to the group I believe (I don't have data for that).

In the same company, the top should not be paid x% more than the lower salary. In the same country, the maximum wage should not exceed x% more than the minimum wage (after taxes).
This is an old article. Here’s a comment I wrote back in 2018 explaining one major problem with it:

https://news.ycombinator.com/item?id=16889222
> I think we have different bars for "not as bad"

We probably don’t, but you’ve gone out of your way to misrepresent my comment so I don’t know where to go from here. Edit: and not the first time you’ve done this to one of my comments in recent times either.

Here is the exact video I meant. They don’t seem to be wearing gloves either. https://www.tiktok.com/@ddcustomz/video/7068406130653170991?...
Yes, but I'm guessing you still can't blast someone on the opposite side of Earth with a stream of neutrinos going right through the core.
Legal change requires a go live on a certain date.

Modernizing and moving functionality to the cloud now instead of in a few months prevents renewal of a expensive contract.
I’m surprised there isn’t way more of this stuff. The supply chain is so huge and therefore represents so much surface area.
The team has been absolutely decimated and its essentially abandonware to Google at this point (i.e. runs on the Nest Hub ghosts ships). The long term story sold to the young and fresh-faced, you can kind of smell through the roadmap, RISC-V.
Eurasian brown bears and North American brown bears are ostensibly the same species of bear, but you'd never guess it from the attack statistics. Eurasian brown bears are considerably less likely to attack than their North American counterparts. I think the Eurasian brown bears have been subjected to more evolutionary pressure to be more docile (from people hunting down the aggressive ones more comprehensively and probably for longer than in America.)
All we need is to figure out distributed training
> The post doesn't spell it out but I wonder if they implied there's a suspicion that the person doing the pressuring there is also another sock puppet of JiaT75 as some scheme of getting access to xz

You can get the user's e-mail by clicking the "Reply via e-mail to" on the page. It matches the <firstname><lastname><number>@protonmail.com of the other sockpuppets, and the PGP key for the account was made 1 day prior to their first communication on that mailing list.
It is very hard for me to imagine an engineer who has FU money picking a CEO position that pays hundreds of millions of dollars a year over an innovative, R&D type position that likely pays tens of millions of dollars a year.
University financial aid antitrust class action settlement
> If the detector at Bob's site influences what Charlie would see at an aggregate level

Charlie doesn't see anything. He sends the electrons here and there. He's just produced the entangled electrons, he hasn't measured them. If he did he would destroy the entanglement and ruin the experiment (which is what secure quantum communication is about).

Unless he gets some reply (say a photon or electron sent by Bob), he doesn't know what either measure.

But if he does get a return particle then they're just communicating classically, so why not just pick up a phone?
I sat on the before we begin page for a long time waiting for something to happen before I realized nothing would:

https://imgur.com/a/cvT1iF8
Huh, I guess I missed the part about providing the general result in the technical part (still don't see it, but that makes sense), ultimately that does seem like a good idea. At least I've heard we understand better from examples first and then generalities.

My (admittedly grumpy) gripe is more that the aim of the blog is that "dull" is bad and suggests to add/subtract candid mathematics with "heroes" and "conflict". If the paper isn't _clear_, that's one thing, but "trick"ing the reader to spend more time on your article than they would without the embellishment is patronizing at best and disingenuous at worst.
Any idea of that part was killed several years back, ensuing brain drain combined with firings makes it sort of a non-sequitor to even wonder. It is on life support already, and an obvious target for more Efficiencies™ should the 2020s turn rougher.
You're not too far off the mark. That demo, SwingSet2, was written in 2007 (and possibly still uses the look & feel of that time, I think), but you can run it, unchanged and probably without recompilation on JDK 22 as well as the Wakefield build (native Wayland) it seems.
uBlock Origin has been available on Android Firefox for years.
It's worse than that - imagine if you had a team focused on a pie in the sky AI-based UI that ran on Fuchsia, but over-funded that, and it went nowhere, so it was killed, and then all of a sudden an LLM came out and all the miraculous UI parts seemed possible, but you were stuck with poorly run Android?

https://9to5google.com/2017/05/10/fuchsia-os-hands-on/
Add kids to the mix.

Any cat with a strong interest in getting outside will now do so several times a year.
This is the type of stuff that keeps me using smaller cloud providers. Even medium sized companies don't need the scalability and flexibility of a full cloud offering like AWS (for the most part).
I started out giving people (the perps were uniformly male) the benefit of the doubt, but my patience wore thin with how frequently it happened, and finally I started explicitly calling people out.

I suppose, I should've phrased it as

"I eventually dropped even the pretense of understanding..."

>why on earth would they do that?

Why on earth would a 19 year old male, who has never been away from home before, has likely never seen any real consequences for their behavior before, read a sign that warns them of said consequences, and still decide that those consequences are less bad than walking an extra 100 feet through a locker room?

I assume the same reason that similarly aged college males removed all of the fluorescent light tubes from the hallways of their own dorm. Or the same reason at least one of the shower drains in the dorm's men's communal bathroom was plugged with paper towels every month.
About the Xz Backdoor
Depending on how it's being used. Rotary engines are better in some ways when being run hard (ie as a track car) compared to more traditional layouts.
This is an intelligence agency trying to add backdoors to archiving software... likely targeting other utilities as well with same MO
Same background as me. The times I 'voluntarily' skipped school were funerals of relatives. I think our perspective is the more common one in the general population, but I guess HN has a lot of those sort of people.
The problem here isn’t emotions, it’s selfishness. When people say a lack of leadership, they mean a lack of giving a fuck about someone other than yourself. These kids only cared about themselves. They still only care about themselves!

You're getting all of the above from a one-line quote saying a person who was an unwitting participant in this experiment now considers it to be unethical? Sorry, but it seems like you're looking for something to get mad about to shore up your (quite reasonable) objections to to a tax policy.
> are modular and can be easily disabled.

That's a common defense for any bloatware. If they're modular and easily disabled then why are they all enabled by default?