skysight-inc/HackerNews huggingface dataset:
>The question is, how rapidly does the "spooky" distance change happen? I get that it would not be communication between A and B or C. I similarly get that you could not coordinate between B and C. But, from all of the framings I've seen so far, I don't understand why the change between B and C is not faster than speed of light.

It's because measurements at B do not convey any information to C while the measurements are performed and vice versa. Unless B calls C to inform them of the choice of measurement setting, C will not know the measurement outcome at B's side. This is true even if they know that they share entangled states prior to prior to performing measurements.

> Edit: Also, to add, my understanding is that they are not "getting angles" per se, but would be seeing distributions. Which is why you would need more than 1 particle, as it were. So, you would say of the X I have recorded, 30% have been blue, 70% have been green. I suppose the concern is that you have no way of knowing when the "100%" mark is done until after classical communication, such that it is impossible to know what the final distribution you are measuring is? Effectively?

There has to be post processing of data where they drop the results of rounds where their measurement choices don't match. This is important because of what's called non commuting measurements. Measurements in one setting don't give us any information about measurement outcome in another setting. So effectively at one end, they have to record their measurement choice and corresponding outcomes of said measurement. And when comparing the data, the participants only have to keep the outcomes of rounds where the measurement choice is the same at both end
We thought that building tech/computers would reduce the number of hours we had to work per week. That didn't happe. AI won't do anything to make our lives better at best, at worst it makes humans unneeded cattle to be culled.
Did you mean MPLS? Or could you link to MLS?
> Despite all this, though, the MX-30 R-EV still falls somewhat short, with a catalog fuel efficiency of 15.4 kilometers per liter (as measured in WLTC mode). With no similar vehicles on the market, like-for-like comparison is not possible, although the Toyota RAV4 plug-in hybrid gets 22.2 km/l, while the Prius plug-in hybrid gets 26.0 km/l. The MX-30 R-EV is clearly inferior in terms of its fuel economy.

That's because the engine serves an entirely different purpose. The Prius plug-in hybrid is a 13.6kWh battery mated to a regular engine. The MX-30 R-EV is a 17.8 kWh battery mated to a tiny ultralight emergency range extender.

As to similar designed cars, um, hello, the BMW I3 Hybrid? Exactly the same design.

The failing of the MX-30 R-EV is that its battery size is pathetically small for what amounts to an EV with a range extender. It is an embarrassment.
There's https://rustdesk.com
Related:

Awk As A Major Systems Programming Language, Revisited (2018) - https://news.ycombinator.com/item?id=22304017 - Feb 2020 (80 comments)
A federal investigation into what, itself? The primary actors doing this type of thing are the US Government.
You can say that again [1]:

[1] Biden to inject Intel with CHIPS fab cash 'next week':

https://www.theregister.com/2024/03/15/biden_intel_chips_fun...
Note that in this case the backdoor was only inserted in some tarballs and enabled itself only when building deb/rpm packages for x86-64 linux and with gcc and the gnu linker. This should already filter out the most exotic setups and makes it harder to reproduce.
It has nothing to do with sentimentality.

Wankels have tremendous power-to-weight and power-to-size ratios. Their main problem is reliability. The generally accepted solution to improve rotary engine reliability (oil injection) results in poor emissions. The wide, flat-ish combustion chamber doesn't help the emissions problem, either.

The Wankel is at its most efficient and its most reliable when operating at a constant RPM. Conveniently, the EV generator application demands a pretty flat RPM band. As a result, the engine doesn't need to lean as hard into those emissions-increasing compromises.

Thus, EVs allow the Wankel's benefits over a reciprocating-piston engine to be reaped without the same costs as before. In theory, at least. It remains to be seen if the benefits will outweigh the drawbacks. I'm glad they're at least going to give it a try.
To be fair, so could closed source code.

The difference in this case is that a guy was running perf tests against postgres and noticed his ssh was slow, so he dove into that and found the backdoor a couple days after it was pushed.

If you had to submit 'my ssh daemon is slow' to a third party it would get put on the pile with the rest of them
Yeah thanks for saying this; I agree. And as cliche as it is to look for a technical solution to a social problem, I also think better tools could help a lot here.

The current situation is ridiculous - if I pull in a compression library from npm, cargo or Python, why can that package interact with my network, make syscalls (as me) and read and write files on my computer? Leftpad shouldn’t be able to install crypto ransomware on my computer.

To solve that, package managers should include capability based security. I want to say “use this package from cargo, but refuse to compile or link into my binary any function which makes any syscall except for read and write. No open - if I want to compress or decompress a file, I’ll open the file myself and pass it in.” No messing with my filesystem. No network access. No raw asm, no trusted build scripts and no exec. What I allow is all you get.

The capability should be transitive. All dependencies of the package should be brought in under the same restriction.

In dynamic languages like (server side) JavaScript, I think this would have to be handled at runtime. We could add a capability parameter to all functions which issue syscalls (or do anything else that’s security sensitive). When the program starts, it gets an “everything” capability. That capability can be cloned and reduced to just the capabilities needed. (Think, pledge). If I want to talk to redis using a 3rd party library, I pass the redis package a capability which only allows it to open network connections. And only to this specific host on this specific port.

It wouldn’t stop all security problems. It might not even stop this one. But it would dramatically reduce the attack surface of badly behaving libraries.
Apologies, I screwed up the names there. I was thinking down thread where I had A sending. So, A sends, B has a detector, C has a detector. Framing I've seen had it such that depending on the setting of B's detector, C would get a different result. (And vice versa.) Now, I am assuming I saw an incomplete framing where this is only true if they communicate back to A?

Stated differently, the framing I saw was that the "spooky" action was somehow setting detector C to a specific setting would cause a different reading in detector B. And this was done in such a way that B could not know that C had changed. But, simply getting a new reading at B means that either A or C has changed, necessarily?

And again, going off old memory. Never my area of study, such that I assume I am misunderstanding. It is frustrating because most "pointing out my mistake" assumes I care about individual protons. I'm saying if we can agree to have A set to send with constant rate, then barring that getting broken, it seems you have a scheme whereby B and C can know what they are doing in aggregate.
Or use GKE/AKS/EKS and save on the salaries needed to operate clusters and hardware
Fair enough. I suspect that this becomes obvious slightly later in the story. The way that the first season is presented on Netflix, there's really a bicameral distribution of possibilities here -- either the Sophons successfully suppress human tech development and the San Ti have no issue doing whatever they want even without realtime information due to technical edge, or they fail and no matter how much information the San Ti have it won't overcome the tech deficit. I'm sure that for story purposes exploring that negligibly small middle part of the distribution where tech levels are comparable at meeting time is most interesting, but as presented it doesn't feel like the San Ti's probability of success changes enough with FTL communication to suggest that they would take different actions in a universe where everything is the same except FTL comms are prohibited.
https://archive.is/cq3EW
Is this your own work? Show HN is for sharing something you've personally created. See https://news.ycombinator.com/showhn.html

I ask because I don't see any indication of that on this post or the other one (https://news.ycombinator.com/item?id=39867639).
People post their own projects all the time. It's so popular there's even a "Show HN" convention.

You run into issues where you use it for things that should be traditional marketing.
Doctor Manhattan
Because the version of entanglement in general knowledge is a fantasy popularized by sci-fi.
A parliamentary system as used in Germany works rather differently than the three-way bun fight in the US.

The government wrote the law, not individual parliamentarians(for that reason we don't call them "lawmakers"). The first lines at the top of the PDF say "Reference Draft of the Ministry of Digitalisation and Transport".

The government is made up like it is, because it has majority control of the parliament. The members of the parties usually do what they are told, partly because they won't get a job in the government if they rebel against party policy.

If the government couldn't get it's own laws through the parliament, this would be extremely embarrassing for them and the government would probably collapse and be replaced by a new government, so they will not introduce any bill unless they have resolved conflicts which would prevent it from passing.

There is a second house. Similar to the US, it has a handful of representatives from each federal state. However, these representatives are appointed by the state governments and are required to vote according to instructions received from the state governments. Also, they only have to be consulted about certain types of laws. It is extremely rare that they veto anything passed by the main parliament

So there will be some debate and probably some amendments, but the chances that the government tries to do something and completely fails is low. Conflicts are solved through negotiation and it's in no-ones interest to grandstand.
Bear in mind that almost all governments in Germany are multi-party coalitions, so the best way to ensure you never have any power is to refuse to compromise.
complexity doesn't matter really... You aren't going to be reading these with a hex editor. What matters is that decompression software is widely available today, and will be long into the future. While thats kinda true for .xz, it's far far more true for .zip.
If you're an employee, and a member of the public is in your workplace, then you have a reasonable expectation that they will behave according to the rules of that workplace. Often these rules are for safety, and for sure it is absolutely reasonable to scold strangers if they have zero situational awareness.

I work in a medical practice. We have an expectation that people will obey rules for their and our protection. For example: we had a sign that, at our reception desk, that people should stay behind a line and not approach too close.

There was a thick, clearly visible tape line on the floor.

There was a two large signs on reception desk asking patients to stay behind the line.

This is during the heightened awareness of the pandemic. People were asked to change their behavior in many ways.

Patients would just come up to the reception desk and lean over the desk.

Damn right I "scolded" them for it. I mean, I didn't roast them, but I used a tone of voice, and asked them to step away from the desk, and pointed out the signs. Some of them were cranky about doing so ... when SARS was rampant!
This is not that costly. Growing bonsai trees also takes a lot of patience, decades, but you don't have to grow only one at a time, the pros are growing them in large numbers, with minimal work on each individual trees once in a while.
Note that these neutrinos (from the collider) have much higher energy than those from a supernova.
Remember that agencies like NSA, GCHQ etc will always use false flags in their code, even when it doesn’t have as high risk of exposure as a backdoor in public has.

Looking at the times of commits shouldn’t be given much value at all. A pretty pointless endeavour.
Haven't heard this argument before. But from the Wikipedia article it seems base 3 has the best asymptomatic radix economy, but isn't much better than base 2 and base 2 is seemingly easier to program and optimize.

Since this is a new argument I've not heard, would be curious if you had links or some more explanation.
Correct. This isn’t a death penalty case.
“Just some random employee” as in… the person tasked with maintaining security and safety of the facility?
Make sure you stop at Stingray's! We drive a very similar route annually and it's amazing (super fun place for kids too).

https://maps.app.goo.gl/fcCBmm1uMtzp4asT8
Related ongoing threads:

Xz: Disable ifunc to fix Issue 60259 - https://news.ycombinator.com/item?id=39869718

FAQ on the xz-utils backdoor - https://news.ycombinator.com/item?id=39869068

Everything I Know About the XZ Backdoor - https://news.ycombinator.com/item?id=39868673
Sure because it’s impossible to have another Madoff in the traditional Wall Street system? No. And some people have found themselves in clawback if they made their money back. Imaging someone investing in Madoff for 25 years and finding out that the investment is a scam, losing their capital but also the state is now after them for hundreds of thousands of dollars.
Ah, life is more complicated than I thought.

First, thank you, for information about such thing! I've worked on create Lora network for large City in 2017, and at that time this all look like Babylon tower, where everybody talk on his own language and even existing standards was not widely adopted.

Second, as I said before, as I see, regulators just now (about cup years) noticed problem of Smart Meters standards missing, and work still in progress.

From what I see, situation is very similar to automobiles with self-driving - some countries are more involved and for some reasons have more ready for self-driving environment (like tiny Singapore). In others things on different stages. Somewhere pilot projects appear and running some temporary regulations. Somewhere autopilot is just unnoticed for regulators, they doing things like 20 years ago, when these technologies just does not existed.

And as engineer, I could say, I just understand, why Smart Home devices manufacturers made communications hub, but I also must say, I have few Smart Home devices and I not planned to buy communication hub - I just made my own firmware (to be honest, what I have are all clones of ESP32 and I customized firmware from some opensource) and connect them to my own server.

And you may already guess, in my country regulators are just ignore Smart Meters.

BTW, greetings from Ukraine, country at war! I don't know exactly why this happen, but looks like exist some Smart countries, which are much more successful than others in use new technologies for good.
Philips PX-2000 Portable communication terminal
> "our findings suggest that inflammation in certain neurons in the brain's hippocampal region is essential for making long-lasting memories."
> "This inflammatory pathway is best known for triggering immune responses by detecting small fragments of pathogen DNA."
The main problem is state, it’s too big and scattered. If it was just one db that knew everything that would be easy enough to snapshot, but there’s multiple dbs and s3 buckets and messages on queues and its all spread out. We could, with a bunch of work to make stuff actually portable, spin up a complete new environment, but a lot of the work that happens is related to synchronizing state and since all the state is scattered we can’t make an atomic clone of it.

Then of course there’s always the issue of people taking shortcuts, “i will test this once then we know it works then i’ll just hardcode this thing”. Making stuff truly impotent and portable is extra work for a “nice to have” of a feature env. YAGNI, until you do. For most devs they’re happy to have something that works and they can move on and ship the next thing.

Personally i’m a big fan of monoliths because they supposedly make this stuff easier. Then again i’ve never worked on a huge one and my colleagues much prefer spinning up an “isolated independent loosely coupled” service to adding it in the main app.
Objectively quantify, sure, but even a subjective qualitative measurement has meaning to us as humans despite it being of no scientific value. It's subjective too - plenty of people have an alcohol addiction problem and plenty of people are actually able to drink responsibly, which suggests not all addictions are equal, for all people. Some people can even do heroin and be fine and not get addicted.
Time, Structure and Fluctuations: Nobel Lecture, 8 December, 1977 [pdf]
I cycled along the Danube (all of it) in 2013.

The packs of wild dogs were not a problem at all. The individual dogs "defending" their property from cyclists were a pain. I had a water bottle and a stick to get rid of the less and the more persistent ones respectively...
I guess the point is this is a very long race and, actually, the end is still quite far away (if that end is AGI).

In his Lex Friedman interview Altman asks ‘what has ChatGPT really fundamentally changed about the world?’ - basically making the point that they’re still just getting started.

Having a tonne of compute and cash is still going to be really important in this race. You have to make it to the finish line to win.
Looking forward to a bunch of overhyped presentations about mediocre AI integrations that never turn into anything useful and get quickly scrapped
I am interested in annoying people who believe in the flood by providing intentionally wacky and untestable theories, as a joke.

I don't need a YouTube video to make that kind of joke, and I'm unkind to people who think those kinds of videos are anything more than jokes

Allow this thought into your head, dear chooms: The best scientific explanation for the flood, hands down, is the process of mythopoesis.

That's what the flood is quite likely all about, and it would be good to make peace with that. We have evidence that people tend to spread false stories over the generations, more so than they spread truth.
They were obviously on autopilot. People are sometimes tired, may be going through a lot, think about something else at the moment, and just don't read every sign on every doors they find. You sound a bit bitter here. I know I am friendly distracted and made many similar mistakes in my life - but never intentionally.
Interestingly on of the accounts that the GitHub account who introduced the backdoor follows was suspended very recently [1] who is also part of the org who runs XZ

[1] https://github.com/JiaT75?tab=following
Regarding the libarchive change:

> This commit does not do what it says it does. All it does, in fact, is replace safe_fprint with an unsafe variant, potentially introducing another vulnerability. The code was merged without any discussion, and lives on to this day. libarchive should also be considered compromised until proven otherwise.

This is very far from the truth, from what I can tell. If you look at the PR, it does, in fact, add strerror(errno) to the end of the error line, as it claims in its description.

And the switch from safe_fprintf() to regular fprintf() for the archive_error_string matches the rest of the codebase, which is scattered with calls to lafe_errc() and lafe_warnc() with archive_error_string (forwarding to vfprintf()). If the contents of that string were considered sensitive to print out, then it would hardly be a new vulnerability. Especially compare the code in tar/write.c, which calls fprintf(stderr) to output the archive_error_string in precisely the same way as the PR in question does.

Note that safe_fprintf() has nothing at all to do with memory safety: its only purpose is to escape unprintable characters before printing them. Indeed, a stack overflow bug within the safe_fprintf() implementation was the subject of a CVE in 2022 [0].

[0] https://github.com/advisories/GHSA-c42q-jv3x-rq38
That is what I thought too but it wasn't hard to find:

https://darknetdiaries.com/transcript/21/
You have perfectly put into words, all my thoughts.

I have been thinking about ways to secure myself, as it is exhausting to think about it every time there is an update or some new dependency.

After this attack, I think the only sure way is to unplug the computer and go buy goats.

The next best thing? Probably ephemeral VMs or some Codespaces/"Cloud Dev Env thingy". (except neither would save me in the xz case)
Fundamentally there is no difference. In practice Rust makes things a lot worse. It encourages the use of dependencies from random (i.e. published with cargo) sources without much quality control. It is really a supply chain disaster to happen. A problem like this would propagate much faster. Here the threat actor had to work hard to get his library updated in distributions and at each step there was a chance that this is detected. Now think about a Rust package automatically pulling in transitively 100s of crates. Sure, a distribution can later figure out what was affected and push upgrades to all the packages. But fundamentally, we should minimize dependencies and we should have quality control at each level (and ideally we should not run code at build time). Cargo goes into the full opposite direction. Rust got this wrong.
From what I'm understanding it's trying to patch itself into the symbol resolution step of ld.so specifically for libcrypto under systemd on x86_64. Am I misreading the report?

That's a strong indication it's targeting sshd specifically.
It mandates it for everyone. I'm locked out of Github because fuck that.
Killing your pipeline for innovation and talent development doesn't make you secure, it makes you fall behind. The Soviet Union found this out the hard way when they made a policy decision to steal chip technology instead of investing in their own people. They were outpaced and the world came to use chips, networks, and software designed by Americans.
In multi-modal land, check this out: https://www.nict.go.jp/en/press/2023/11/30-1.html#:~:text=Hi....

In Oct 2023 they did 22 Pbps, a lot more than this experiment, but imagine adding the E spectrum to that.
I'm reading that as the distributions that are seen are not stable. It may be that you got 30% this time, but 40% next time. On the exact same setup. (Obviously making up numbers.) Yes, you know that the other side saw something, but that is obviously useless.

Framing I saw was more of a truth table like where B/C have known states they can be in that each lead to a known distribution of outcomes. It was not clear that the known distribution was only an observed distribution.
This right here. This is exactly what I would be doing - find small broke maintainers offer them a few hundred grand - with a target in mind.
Why not `git archive`?
Rust does not claim to prevent memory leaks.
We detached this subthread from https://news.ycombinator.com/item?id=39867106.
Many:

https://www.theregister.com/2022/02/23/chinese_nsa_linux/
This is great!

I was looking for something like this.

Now I just need a guide that tackles the principles of this, but from a typescript/javascript perspective.

PS: TyTorch (from Typescript) sounds nice!