skysight-inc/HackerNews huggingface dataset:
My impression is that it did not get into latest Ubuntu, they were in the process of trying though.

The end goal seems to have been to get it into the LTS releases of rhel and Ubuntu. Since this was a valuable it's probably something kept around for when other methods fail. I doubt it would be used before the really valuable systems are compromised (rhel and Ubuntu in cloud and governments)
just feed the renewable to the grid? I suppose it could make some sense at peak solar hours to 'waste' the solar power to scrub co2 from coal plants that can't be shut down easily, but it still seems incredibly wasteful.
ffcc33

I'm going on supermarket starfruit here so might be a bit off :)
I agree with you, I'm just unclear about the process by which people think this system could be updated for accuracy. I think manually verifying every possible answer means that the solution is to not use transformer models for this task.
As far as I can tell your “software as a 'service'” is fundamentally a blog-spam generator?
This is probably the worst backdoor in history in the open source sphere, if not ever.

Certainly the worst of my career.
They’ll need to be better and more autonomous to justify the prices

No one is going to pay $100 for “better than Google search” chatGPT, even if its AGI tier

But paying $100 for a “junior dev who takes over all the grunt work” is still a value buy
...or forces a well-respected contributor to add evil code under duress.
Putting dermatologists out of business… lol.
An OLED iPad Pro and the first big-screen iPad Air will reportedly arrive in May
>the economic incentives currently in place to harm children

I really do not believe in that. There isn't a single person in the world who chooses to be a child pornographer because the economics of it are good. They do it because it allows them to carry out their sexual fantasies, which are about abusing children. The abuse has to be the point, if it weren't just abstaining from it would be the only choice.

It is extremely easy to comprehend that your sexual urges (which can be satisfied in a myriad ways) are monumentally less important than a childs wellbeing. Choosing your urges means that you are doing it because of the abuse, which of course any virtual recreation can not provide.
KARAMJAMEELMOORE.WORDPRESS.COM
Sure, I can give you detailed answers:

1- The answer is still ~1.7GB. You only need meta-data of a single nn.Linear at a time. There are 32x(4+3) = 224 layers quantized, so you need an additional (3GB - 1.7GB)/224 = 1.3GB/224 ~ 5.8MB, which is negligible.

2- As the table says, that's the forward pass. (Batch-size=1, context-size=1024). Forward pass means there's no caching and no decoding logic. The actual model generation speed should be much faster with caching + decoding logics like speculative decoding, and using VLLM instead of HF. And even with all of that, a much larger model like Mixtral with the same group-size of 8 offloaded to the CPU works quite well on a 4090.

You mean why it's faster than Quip# despite being all on-device? Because dequantization with HQQ is a simple linear operation. It's not even using a fused kernel, only the dequantization part is done on CUDA.

3- LoRA absorbs -zero x shift, not the shift, the shift is still there, including the BitNet/1.58 work. As the paragraph explains, the math is ignoring reshaping to make the math simple and easy to read.

Let's say you have a matrix of 4096x4096, with grouping done channel-wise (but no reshaping), the -zero x shift part is a rank-1 matrix (4096x1 .dot 1x4096), the lora data will be (4096xr .dot rx4096), you can merge them exactly into (4096x(r+1) .dot (r+1)x4096).

The point of that paragraph is to show two things:
- Compared to the BitNet formulation, the additional zero-point (which is necessary to get good quantization results on pre-trained models with minimum calibration), has a negligible overhead.
-More importantly, it explains how we even got the idea of adding low-rank adapters: it's not because LoRA is popular, it's because the zero-point alone results in a rank-1 matrix error which is not enough to express the quantization error. As the rank tends to min(num_rows, num_cols), the error goes down. So if we increase the rank by r via low-rank adapters, we would expect better results.

Now, if we include the reshape with a lower-group size than the num_rows, the -zero x shift part is a rank-n matrix (4096xn dot nx4096), but it's not possible to properly estimate the rank n because that would highly depend on the nature of the weights matrix, but in the end, the LoRA part will be (4096x(n+r) .dot (n+r)x4096). We only use a lora rank of 8 for MLPs which are the larger matrices, so even if you double or even 4x to let's say n+r=32, it's still just 1/128=0.78% of the original matrix.

Merging -zero x scale with the low-rank adapters or not doesn't matter much, that would highly depending on which fused kernel implementation performs the best.
As someone who knows very little about colors, it was quite fun to see how much green is a light shade of purple I got. Could probably get better at guessing base RGBs I want for thing X on a frontends I build by playing this.
> but that we do a terrible job introducing people into our culture.

If you're a community of 100 people, and suddenly you get an influx of 10000 people, then there is no "introducing people to our culture" anymore. Then you got a "introducing you to the newcomers' culture".

They won't listen to your in jokes, or even care about understanding them (they might prefer to just be offended for not getting them). They won't listen to the carefully thought-through stuff already in the community, but rather shove some hype in. It is lower-effort to keep doing what you did, to keep following some hype that got you where you are, so unless you are basically forced to consider something else, you'll instead force the oldies in the community you are flooding to follow your suit instead - by sheer mass.
SHA:256/A
Well one is actual company and other is a money laundering scheme to funnel foreign money to potential future president...
Sure, but my experience is that once you’re somewhat established this is not something that takes nearly 30% of your time. It’s more about passively keeping up with your network, and work tends to find you.

Rules for working with one client really differs from country to country as well, even within the EU. I believe Germany is quite strict on it but no problems at all in Sweden for example.
On servers? I am sure that’s not true. And I doubt most people run ssh daemon on desktop. And if they do they aren’t exposed to the internet I hope.
Discord to Start Showing Ads for Gamers to Boost Revenue
https://archive.ph/SPgOM
But don't forget that xz is also used as part of dpkg for unpacking packages.
The whole purpose of dpkg is to update critical system packages. Any SELinux policy that protects from a backdoored dpkg/xz installing a rootkit during the next kernel security update; will also prevent installing real kernel security updates.

The particular way of attack in this OpenSSH backdoor can maybe be prevented; but we've got to realize that the attacker already had full root permissions and there's no way of protecting from that.
Thank, you for participating in the open source community by sharing your opinion. Your contribution is valuable but not consistent with the direction we are currently going in at this time. Please don't let this stop you for further participation.
If you use a good tool like Gerrit, then you can see a diff of changes made in a review since an arbitrary previous version of the change.
there are cultural norms and expectations at play here, which I feel need to be modified somewhat

this is an important observation.

a change of culture is really what is needed here, because it implies that not only maintainers change their behavior, but everyone involved, and the question is not so much what any individual can do for themselves, but how we can help others with that change and spread it
I’ve never seen a server with a rolling distro tbh
The world could always use more people like that.

Something something effective altruism.

It doesn't even need to be altruistic. One would expect that out of sheer self-interest, one would look into propelling humanity forward by elevating and liberating as many people as possible, enabling the brightest of our species to solve the hardest problems and elevate humanity. Though accepting that one needs others to solve problems one does not understand, that they play a supporting role, takes a great deal of humility.
i can attest to the fact that AI in its current form is still incapable of replacing even low-level artists. in my current business, i required a bunch of cartoon/comic images and i tried really hard using various AI tools to generate something based on my description, and none of it was usable.

i then spent $5 on Fiverr to hire a comic artist in Indonesia to do it, and within 24 hours I got a really wonderful deliverable back.

i will continue to use cheap artists in developing countries for my graphics. AI just doesn't cut it - yet.
Usually, I try to use projects in languages I work with so if the issue is not important enough for me to make a PR, then it’s not important enough. One thing I wish were possible is to sponsor an issue. I don’t usually sponsor open source projects, but I would likely sponsor a lot of issues just to speed up resolution. I think this could move a lot of projects in the right direction. Depending on difficulty, the maintainer could define a budget to have it in the roadmap with a reasonable timeline defined by them, maybe measured in quarters.
Because many school Maths teachers are fundamentally bad at teaching the subject and when this abstract subject naturally is difficult for young pupils to absorb, in the end they default to "because it is that's the way it is, and you just have to learn it!", roughly put.
Worst as in "bad" or worst as in "did not have any impact as a backdoor"?
If OpenAI has to make a profit or at least lose less money to please investors, they will raise the price of GPT4 or flat out cancel it.
Pay is not the only thing regarding maintainership.

Time is another factor. It takes time to maintain software, improve the codebase, add features, etc. Then there are the other tasks such as answering questions, reviewing PRs, triaging bugs and feature requests, etc.

So getting more contributors, people to assist with bugs and bug investigations, etc. is arguably more important. Especially projects developed by a single person, or a small number of people. That's the avenue that opened up this attack.

It is easy to get burned out implementing features that end up being more complex than expected, interacting with users that want different things from a project, and having a growing list of issues and PRs. That's the scenario that happened with xz, and is common with popular software that is maintained by a solo developer.

The other aspect to this is the direction the maintainer wants to take the project in. If another maintainer has a different direction in mind, that's going to cause tension.
Are there any sample sections available?
Would a model actually perform better fine tuned on such a small data set? Seems to me that just giving it the data during inference of new stuff would net better results, using something like RAG.
Anything can be viewed as a judgement statement if you paraphrase or stretch things enough. I don't think your paraphrasings are a fair representation of what I actually said.

But you can insert "I'm not trying to blame anyone, but here are some suggestions to modify cultural norms so these things are less likely to happen in the future" if you want. Or you can just assume good faith and take that as implied unless demonstrated otherwise.
Raise prices on what? There are barely any revenue generating AI products with a line of paying customers. I look around an I still don’t see anything. At the end of the day there have to be viable business models at the end of the line in order to support all this otherwise this too is just a house of cards.
They're not, the author of the books was certainly good at her job and the profiles of each sign were very different, not possible to automatically generate from a template. But, see, I can tell you how down to earth you are, or how fierce and loyal you are, or how aloof and artistic you are, or how your enemies should fear your terrible vengeance, and while those are all different traits they can all make you feel good about yourself, without even being necessarily positive traits and not even being strong traits of your personality, just by making it all a big deal and making it all about you. That's what those books sell, they unconditionally flatter the insignificant. It's like having a choir following you around and singing Carmina Burana every time you pick your nose.

Also the extra books helped me understand the whole, which I would have missed if I had only read one, so that makes the otherwise wasted money worth it.
Hello everybody.

I am taking the initiative to gather more information regarding the possible precursors and perpetrators of the backdoor.

The purpose of this commentary is focused on open source information (OSINT).

I am not a judge of anyone or any action that may occur, the objective of this comment is to help through accurate and quick information to help the core developers of the affected packages and consequently the Linux kernel (which may have been indirectly or directly affected) take action necessary in relation to the fact that occurred.

NOTE: This comment will always have "edit" so always review it for information.

Information I have so far.

Summary:
1. GitHub Account Suspension:
- The accounts of @JiaT75 and @Larhzu were suspended by GitHub.
- All Tukaani repositories, including downloads, were disabled.
- Investigate the cause of the account suspensions and whether there is any correlation with suspicious activities.

2. Possible Backdoor in xz/liblzma:
- There are concerns about the presence of a backdoor in xz/liblzma.
- Investigate whether there is evidence of compromise in the source code and recent updates.
- Examine potential impacts, especially if the software is used in critical systems.

3. Updates and Patches in Packages:
- Note recent updates in packages such as MinGW w64, pacman-static, Alpine, and OpenSUSE.
- Review changelogs to understand if these updates are related to security fixes.

4. Jia's Activities on Platforms and Projects:
- Investigate Jia's contributions to different projects and platforms, such as Arch Linux, Alpine Linux, and OpenSUSE.
- Check for correlations between Jia's activities and reported security issues.

5. Libera Registration Information:
- Analyze Jia's registration details on Libera to determine the timeline of their online activities.
- Consider correlating this information with other online activities of Jia.

6. VPN Usage:
- Confirm Jia's use of VPN and assess its impact on security investigations.
- Explore possible reasons for using a VPN and how it may affect the identification and tracking of online activities.

Links related to user JiaT75
[xz] Remove JiaT75 as a contact, determine correct contacts #11760 - Google/oss-fuzz
https://github.com/google/oss-fuzz/issues/11760

Tuktest index hash #7 - tukaani-project/xz/pull/7
https://web.archive.org/web/20240329230522/https://github.co...
I've got this keyboard but the Fami Edition (tribute to the Famicom), and am pleasantly surprised at the quality and general feel of the keyboard for a "gimmick" keyboard. I bought it mostly to use on Raspberry Pi projects etc, but have ended up using it as my main daily keyboard on my desktop.
My layperson’s opinion is that anything to do with gaming is particularly riddled with people that interact poorly with maintainers. Again, purely my opinion: gamer culture invites a particular sort of Dunning-Kruger-prone ‘power user’ type. Every gamer community carries with it a corpus of baseless, fictitious, technical information. “The developers didn’t do this because x”, “it’s ridiculous that they didn’t just y”, “They just aren’t listening to users!”

I’m not much of a gamer at all. But the once in a blue moon where I dip my toes in, it’s not that long before I’m met with a forum post or reddit comment making some technical assertion that sounds incredibly presumptuous if not downright incredibly unlikely.
Does anyone know if distros using the systemd-notify patch are considering not linking to libsystemd and instead implementing the notify-protocol themselves?

As this would only be like 10 lines of code, instead of linking a huge library that will in turn pull in another bunch of libs, it seems like it should reduce attack surface.
Both? This is eternal blue, Linux edition, except it was never shipped.
The criticism in the article seems pretty weak. If the goal was an omniscient oracle, then, yeah, probably not the god you were expecting. However, I don't see how this is not more cost effective than an outsourced call center. Speaking to a person in another country who barely understands my language and has 5 scripted responses can't be an improvement. The article does not even speak to error rates for humans performing the same task.
My understanding was that Linus is cooling his jets a bit?
remember Watson?
My original post title: “WSJ: AI industry spent 17x more on Nvidia chips than it brought in in revenue”

Mirror that I should've posted instead https://www.msn.com/en-us/money/companies/a-peter-thiel-back...
I had a very similar computer (100mhz Pentium instead 75mhz) bought in late 1995 and it was not obscenely expensive. It’d be a high end machine for 1994 and obsolete by the late 90s (by 2000 AMD were selling athlons at >= 1Ghz)
When you give your time or participate freely - you already made a choice. If you want to make it a business, make it a business from the start.
https://huggingface.co/fhai50032/BeagleLake-7B-Toxic-GGUF

This one works with GGUF-compatible llama.cpp wrappers like the fully-local, fully-private Layla app or the other examples tossed around. With some prompt tweaking it's capable of a broad variety of... tasks.

This model is very compliant and doesn't tend to go to "I'm sorry, as a large language model..." type replies.
tl;dr. SSH though VPN only. Sleep tight.
First: Apply all official patches via APT. That’s the most important thing. The easiest way to avoid getting pwned is to apply security patches without too long delay.

Then consider defense-in-depth. If you have sshd exposed to the Internet, you could put it behind a VPN such as Tailscale (or pure WireGuard).

And FWIW: With our current knowledge, any LTS version of Ubuntu should not have been affected by this backdoor.
Now that is selling shovels in a gold rush.
You‘re not planning to make anything, you‘re not building anything, you don‘t do anything besides maybe harvesting mail addresses.

Because every few days you have another thing you‘re "building", and they are not even related in any way, except some buzzword like "AI": https://news.ycombinator.com/submitted?id=0xDeveloper
> No way to spot this if you don't know what you're looking for.

I would expect most people to at least ask for more clarification on random changes to `head` offsets, honestly - or any other diff there.

If they had access to just merge whatever with no oversight, I guess the blame is more on people using this in other projects without vetting their basic security of projects they fully, implicitly trust, though. As bad as pulling in "left-pad" in your password hashing lib at that point.

The "random binaries in the repo" part is also egregious, but more understandable. Still not something that should have gotten past another pair of eyes, IMHO.
I got so annoyed that I created Chrome extension that brings clickable maps back.

https://chromewebstore.google.com/detail/google-maps-quickcl...
I had this exact thought today. Awful, isn't it?
Working on an OS in Rust, rust-analyzer chokes. A _lot_. I end up just having to run a compilation to see what I've broken.

Haven't tried it yet but it looks like it'll be an invaluable part of my toolbox. Thanks for posting this!
FDR. Packed the courts and ignored congress by way of emergency powers. Created countless agencies to perpetuate power in democratically and in perpetuity by virtue of the managerial state. Completely changed how America is run.

Not saying it was bad either. Just that he was an autocrat and extremely successful. The moment they could congress weakened the executive branch to the point of near uselessness as we see today.
This is fun. I like the fact you can click anywhere, which is nice for a non-touch device. Probably would help to emphasise those slider ticks as they are almost invisible, it would it more inviting to click instead of drag.
New and more chips will come and make AI more cheap. I do not expect AI too crash, it is too useful.
History repeats, in this AI “gold rush” it’s best to be the person selling the shovels.
If it looks like a bubble and sounds like a bubble…

But AGI
You have it backwards: The notion that open source developers can not or should not ask for monetary compensation for their work is what leads to their exhaustion and their project's demise.

Of course if the developers don't want to be paid, then that's that. But otherwise, there is a very heavy atmosphere in the open source community of excommunicating anyone who dares to ask for payment as heathens of the vilest order.
I’ve seen them in production at a smaller shop.

They do exist. Kept things exciting.
As far as I understand it, you need to check for the version of xz/liblzma.

Run this:

dpkg -l | grep liblzma
# or
xz --version

If you see 5.6.0 or 5.6.1, you should panic, and probably recreate.

But it is unlikely you will see that especially on LTS as they are using an older version. On Ubuntu 22.04 I get version "5.2.5"

Ubuntu 24.04 was about to be affected but they removed that version when the news broke.
At the end of the day this is such low hanging fruit that I don’t think that it’s even worth paying attention to. This was almost certainly a state actor and this detail would be blindingly obvious to all state actors capable of pulling this off. You could choose to try to dissect the 10 dimensional game of chess involved in picking fake names, or you could focus your attention on more meaningful heuristics.
A melancholy purple reminiscent of the twilight depicted in childrens books, 1910, colorized.
This is a cute game that I've played just a bit with some friends. I can recommend it if you like voxel stuff :)
you could apply a binary search for each slider and improve the number of tries by moving the slider by half of the shortest distance to the edge
The hacker's name "Jia Cheong Tan" actually includes phonics from both variants of Chinese from China, Singpore and Hong Kong region, hence no way it is a name of a real person, so the name probably don't indicate anything. However, since the Hong Kong and Singapore variants is rarely used, the group behind the hacker probably has good knowledge of Chinese linguistics. Either way, the fact that the hacker's account shows GMT+8 and that the hacker's activity is mostly in Southeast Asia working hours (read GMT+8) would only make sense if the hacker is originated from Asia countries. I doubt that group of people behind the hack can consistently stay late night for 2+ years just to fake the timezone.