skysight-inc/HackerNews huggingface dataset:
Your logic isn't exactly wrong, but I don't think it applies here. A woman in tech wants to have a discussion about a recent report saying that women in tech are paid less than men for equivalent work. Some people flag it to prevent discussion, some people vouch for it, and in the end the flaggers win. I'd say it's categorically different than a crypto scam.

On the other hand, I think you're right that there is a spectrum. It's hard to find a clear rule that works for everything. People here also want to discuss trans rights, the Christian right, Trump's most recent gaffes, Biden's most recent gaffes, and the wars in Gaza and and Ukraine. It's probably reasonable to declare at least some of these as off-topic, at least most of the time.

On the third hand, there doesn't seem to be a clear rule for which articles get flagged off and which remain. Multiple attempts to discuss the politics that affect Google's public facing products get flagged off again and again, while "What Have Fourteen Years of Conservative Rule Done to Britain?" (https://news.ycombinator.com/item?id=39855704) stayed up.

I worry that we're granting too much of a right to censor to a small minority of users. It's asymmetric, in that the "free speech" side has a very high bar for censoring things, while those with less compunction and more focussed on "winning" use flagging as a tool. Personally, I trust the human moderator (Dan) more than I trust the users.

For at least the articles that have any significant numbers of upvotes, I'd like for him to decide case-by-case whether the article stays or goes according to some principle, even if that principle just whether he thinks it will lead to productive discussion. And I think the article we're discussing here (women's salaries in tech, not lead pencils) probably clears the bar and merits discussion.
What happens if a large std::unordered_map<std::string, std::string> has its destructor called?

The maximum number of references is a red herring. While having a RC capped at 1 allows you to elide the actual reference count and makes pointer assignment cheaper, it does not materially affect the primary source of latency in a reference counting implementation, namely cascading deletions.
So basically they give NES 1MB RAM, up to 3.5GB of NAND-based ROM, expand the PPU capabilities within the supposed circuit complexity of the MMC5, and then proceed to argue it's not anachronistic and was even economically viable at the time?

Roman Empire never came close to inventing communication networks despite having the economic incentives and long-range signaling tech, think about why.
I remember how my parents used to do this together the same way you describe, and I was always getting in their way. It was a lot of fun.
I'm sure there's some niche uses where it makes sense. Fast refueling for example because batteries are so slow. And much heavier than a Wankel engine plus hydrogen tank.

Like in a public transport bus that needs to be on the go all day. In fact I'm pretty sure that's what the hydrogen buses in my city do, they're way too noisy to be fuel cell electric.

Besides, if you can run on electric you can bypass the whole hydrogen step altogether.
FOIA Consumer Complaints, Privacy [pdf]
Start 'Bitwood' - it might become a thing...
From what I’ve read I think the attack vector is:

1. sshd starts and loads the libsystemd library which loads the XZ library which contains the hack

2. The XZ library injects its own versions of functions in openssl that verify RSA signatures

3. When someone logs into SSH and presents a signed SSH certificate as authentication, those hacked functions are called

4. The certificate, in turn, can contain arbitrary data that in a normal login process would include assertions about username or role that would be used to determine if the certificate is valid for use logging in as the particular user. But if the hacked functions detect that the certificate was signed by a specific attacker key, they take some subfield of the certificate and execute it as a command on the system in the sshd context (ie, as the root user).

Unfortunately, we don’t know the attacker’s signing key, just the public key the hacked code uses to validate it. But basically this would give the attacker a way to run any command as root on any compromised system without leaving much of a trace, beyond the (presumably failed) login attempt, which any system on the internet will be getting a lot of anyway.
It poses an annoyance, If you move to the US, get married, then attempt to get a driver's license it sets your plans back at least a few weeks while you get the paperwork done.
Apparently changed in 2022 to protect consumers.
Which other VPNs? And are you talking about trad VPN (concentrators/hub & spoke)? If so, you wouldn’t be considering Tailscale anyway.
I don't think we know what exactly this does, yet. I can only answer one of those questions, as far as I understand the "unreplayable" part is refering to this:

> Apparently the backdoor reverts back to regular operation if the payload is malformed or *the signature from the attacker's key doesn't verify*.

emphasis mine, note the "signature of the attacker's key". So unless that key is leaked, or someone breaks the RSA algorithm (in which case we have far bigger problems), it's impossible for someone else (researcher or third-party) to exploit this backdoor.
If we ever find a perfect theory of physics, then that might be the smallest program to generate human DNA.
The official channel for the project.
I remember every time I need to get the tigerVNC Viewer I had to go to sourceforge.
The person who submitted the PR, JiaT75, is.

The person who approved and merged it is not.
not only that, but logins show up in logs.
I was never taught this, but I ended up "reinventing" it a few decades ago, certainly because this is the most efficient way ? I have always used this technique since.
Rust and TypeScript for me.
Related question. Why is it that those damn strings break off after a few years? There must be a better way of attaching. Drives me nuts.
Even knowing that it was a dot added, I could not quite easily find this in the diff. Scary...
I suppose it depends on the API. Some languages require grabbing a handle and calling open. Either way, theory is the same!
> Of course the network would not use a VPN but MPLS or something.

So basically the company's devices are provisioned with specific (e)SIM cards that would make the traffic routed to the company's network by the telco directly? If I would be a network admin in a big company, I'm not sure I'd feel well with that, as the provisioning/management of SIM cards out of the company's control. It would also mean that a rogue employee of the telecom operator would be able to access the internal network of the company. Attack surface seems too big.
Sometimes, but the differences in performance between the two were quite vast if I recall correctly.
Evolution at work.

The music industry is so much more competitive today, in the past very few could afford to make music, now anybody can do it.

There is so much supply now that bad songs die much more quickly and only the fittest survive.
I can't blame anyone who has missed that dot dissimulated at the beginning of the line.

https://git.tukaani.org/?p=xz.git;a=commitdiff;h=f9cf4c05edd...
The whole point of Kolmogorov complexity is that description lengths under different Turing-complete description languages (such as UTM and lambda calculus) are only different up to a constant that depends on the languages and not on the thing being described.
prodigal means wasteful. otherwise, beautiful.
Original author here. Thanks for sharing!

I was wondering why my old article was gaining extra attention this morning, suspected it was because of the whole xz fiasco, and it seems that was right. For more details, I think this got popular again because of the link in the investigation at https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78b...
Pinta actually uses an older version of the paint.net image manipulation functionality from when Paint.net was open source, with a rewritten UI (in gtk# if I recall correctly, compared to WPF for Paint.net). However, that new UI is significantly inferior to Paint.net's. One example - last time I tried it, the "marching arts" to highlight selections was sized in terms of pixels in the source image. It was always 1 source image pixel wide, rather than 1 screen pixel. This significantly hurt its usefulness for pixel art type situations.
Popular songs are addapting to a mainstream modern listener which requires repetitive melodies that are easily memorable
It's called progress.

Helix does a lot of things better than other editors, so cherry-picking some minor thing to make it look not worthwhile is just silly.
My sense was this backdoor gets to execute whatever it wants using whatever "user" sshd is running as. So even if root logins are disabled, this backdoor doesn't care.
This is cool! I've also used tesseract OCR and found it to be pretty amazing in terms of speed and accuracy.

I use it for ingest of image and pdf type files for my own website chatting tool: tinydesk.ai!

I run the backend on an express js server so all js as well.

Smaller docs I do on the client side, but larger ones (>1.5mb) I've found take forever so those process in the backend.
You can get a California driver's license. You can't get a RealID or Enhanced license. The state doesn't have the jurisdiction to enforce federal immigration law. Also an SSN is not proof of citizenship and is not enough to get a RealID or US passport, that requires a birth certificate or certificate of naturalization. Most "undocumented" immigrants don't stay fully undocumented for long, they get tax IDs from the IRS to pay taxes, driver's licenses from the states they live in to drive, etc. It's just CBP that doesn't get documentation of them.
Probably multiple top 40 charts from multiple countries.
WTF!?
I heard before that putting a cover on a duvet was a thing, a problem, a mystery...
are ppl making this up? is this a joke I don't get
invert, tie corners together and what not...

my family and everyone i know do it the way @pablobaz describes it.
it's simple and effective. change sheets whenever you feel like doing it, because its easy and fast...
endof story
Wait a minute, if you don't have copies of data in the cloud, you have copies on HDDs and CDRWs? From experience I know that those fail within 10 years or so. Lot's of my data is already 20+ years in the cloud.
If needed, I grab a cover border, and align the duvet border within it, make sure corners are aligned too, and then again : shake it. It comes back to place.
> The OP makes it sound like an attacker can send a malicious payload in the pre-auth phase of an SSH session - but why does he say that an exploit might never be available? Surely if we can reverse the code we can write a PoC?

Not if public-key cryptography was used correctly, and if there are no exploitable bugs.
Wow, just the process of sneaking in this exploit has layers. Here, it's the presentation of diffs with "+" and "-" line prefixes creating noise that's easy to miss. I bet we'll start seeing tools add a divider between the prefix column and the contents to make changes like this easier to spot.

That said, does GCC accept every non-printing character as whitespace? If not, they could probably have achieved the same thing with a narrow-nonbreaking-space character or similar.
https://old.reddit.com/r/webdev/comments/1brp9jn/i_made_a_si...

https://ios404.com/
Linux laptops you can buy: Expert tested
> If the EU can fine Apple and Google, the US should be able to fine Novo.

So what did you mean by that?
Speech and Audio Processing in Non-Invasive Brain-Computer Interfaces at Meta [video]
If the exploit wasn't baing used, the odds would would be pretty low. They picked the right place to bury it (i.e., effectively outside the codebase, where no auditor ever looks).

That said, if you're not using it, it defeats the purpose. And the more you're using it, the higher the likelihood you will be detected down the line. Compare to Solarwinds.
Hard agree. Changing a duvet cover is not hard. Maybe we are just getting stupider as a species.
I wonder if there is anything else cmake related that should be looked at.

Wasn't cmake support originally added to xz to use with Windows and MSVC?
It’s not necessarily easy to move a significant project to another build system.
And before crawling into it.
That is long dead, try AIMP, it even supports Winamp dsp-s.
Ah, I see where you are coming from.

You are correct, sustained load heap size of SRV GC has been a known pain point that had been particularly exacerbated after beefy Windows Server hosts fell out of fashion and got replaced by 512Mi Linux containers.

There has been work conducted on this each release throughout Core 2.1, 3.1, and then 5, 6, 7 and 8 versions to make it play nicer with more constrained memory limit systems.

The two major features that address this are Regions[0] (.NET 6/7) and DATAS[1] (.NET 8). The former is enabled by default everywhere except macOS and the latter is available opt-in either via env var DOTNET_GCDynamicAdaptationMode=1 or msbuild poperty GarbageCollectionAdaptationMode: 1 (see more in [1]).

The latter has shown to significantly reduce sustained (or, especially, idling) heap size for some particularly problematic workloads (but not all, sometimes you just have a lot of live objects). I definitely recommend giving it a try if this is something still relevant to you.

TLDR of what DATAS does is dynamic heap count scaling and much smarter heap up/downsizing depending on allocation rate/frequency and anticipated throughput impact of adjusting those.

[0] https://itnext.io/how-segments-and-regions-differ-in-decommi... / https://devblogs.microsoft.com/dotnet/put-a-dpad-on-that-gc/

[1] https://maoni0.medium.com/dynamically-adapting-to-applicatio...
That’s how I learned it from my mama and that’s what ill teach the children.
Why is this a problem? No information is lost when characters (or graphics) are encoded in binary.
Wait until everyone realizes the drug does more harm than good.
It just stays.
> TAs can be great, but they're likely someone with limited pedagogical experience.

Professors can be great, but they're likely to be experts and researchers who find the course material trivially easy – and have long forgotten what it was like to learn it for the first time as an absolute beginner.
US laws prioritize corporations over people.

EU laws prioritize people over corporations.

So EU corps selling in the US can bleed their customers dry, just like the local US corps.

And US corps operating in the EU are restricted in the people's interest, just like the local EU corps.

This is the just application of the respective laws as they stand.

This is the outcome the respective populations voted for.

Although the rest of the world does wonder what the US voters were thinking ...
A readable top output.
Yeah these types of security issues will be used by politicians to force hardware makers to lockdown hardware, embed software in chips.

The go fast startups habit of “import the world to make my company products” is a huge security issue IT workers ignore.

The only solution politics and big tech will chase is obsolete said job market by pulling more of the stack into locked down hardware, with updates only allowed to come from the gadget vendor.
I think this would’ve been difficult to catch because the patching of sshd happens during linking, when it’s permissible, and if this is correct then it’s not a master key backdoor, so there is no regular login audit trail. And sshd would of course be allowed to start other processes. A very tight SELinux policy could catch sshd executing something that ain’t a shell but hardening to that degree would be extremely rare I assume.

As for being discovered outside the target, well we tried that exercise already, didn’t we? A bunch of people stared at the payload with valgrind et al and didn’t see it. It’s also fairly well protected from being discovered in debugging environments, because the overt infrastructure underlying the payload is incompatible with ASan and friends. And even if it is linked in, the code runs long before main(), so even if you were prodding around near or in liblzma with a debugger you wouldn’t normally observe it execute.

e: sibling suggests strace, yes you can see all syscalls after the process is spawned and you can watch the linker work. But from what I’ve gathered the payload isn’t making any syscalls at that stage to determine whether to activate, it’s just looking at argv and environ etc.
Source Forge failed when it started bundling mallard with binary downloads. Case closed!
I think I used it from 1997 till 2001, all years I owned a windows pc. And until 2005 at windows pc at work.
Marketing spend dwarfs (dwarves?) R&D costs by multiple factors.
The Voice of Siri Down Under
> What does "strategy" mean here?

Any function that outputs bets.
I've said it before and I'll say it again: expiring certs are the new DNS for outages.

I still marvel at just how good Tailscale is. I'm a minor user really but I have two sites that I use tailscale to access: a couple of on-prem servers and my AWS production setup.

I can literally work from anywhere - had an issue over the weekend where I was trying to deploy an ECS container but the local wifi was so slow that the deploy kept timing out.

I simply SSH'd over to my on-prem development machine, did a git pull of the latest code and did the deploy from there. All while remaining secure with no open ports at all on my on-prem system and none in AWS. Can even do testing against the production Aurora database without any open ports on it, simply run a tailscale agent in AWS on a nano sized EC2.

Got another developer you need to give access to your network to? Tailscale makes that trivial (as it does revoking them).

Yeah, for that deployment I could just make a GitHub action or something and avoid the perils of terrible internet, but for this I like to do it manually and Tailscale lets me do just that.
While it was quaint to read through the high effort blog post, it was like reading a cooking blog that starts off with reminiscing about travels through an Italian village where they learnt how to make toast.
The medium (or in this case the distribution) is the message.

This isn’t artist’s fault, or ‘this generations’s’ fault. This is an industry being pushed by a few algorithms that control the diffusion of new music to people which are optimising for this kind of thing.
Images don't show in my Firefox.
As a short person, my strategy is to stand on the bed for extra height for this method. Or just be lazy and accept the slightly uneven distribution, which works itself out after the first night anyway.
None of the apartments I've lived in for the past few years have had a washer large enough to wash a king-sized comforter, so I use a duvet instead.
The example on the Tesseract.js page shows it highlighting the rectangles of where the selected text originated. Does this level of information get surfaced through the library for consumption?

I just grabbed a two-column academic PDF, which performed as well as you would expect. If I was returned a json list of text + coordinates, I could do some dirty munging (eg footer is anything below this y index, column 1 is between these x ranges, column 2 is between these other x ranges) to self-assemble it a bit better.
I agree with you about Hermes and actually the majority of the lines by most of the houses (not the cheap lines), but when you talk about fashion here, a lot of people think about the branding-focused groups like Gucci, Tiffany, or Louis Vuitton.
Superdry is a UK brand. They just make use of Japanese aesthetics.
Not nearly as much as they claim they are. The system is basically rigged in their favor. Just compare the financial statements of companies like Ford and Boeing to Eli Lilly and Novo Nordisk. Pharma does very good business.
Tell the LLM the business context
Perhaps when you’re willing to trade a prestigious title for some sanity and personal satisfaction you’ve already determined that it doesn’t matter what your peers think or what gets decided.

They key is that you can’t just stop doing what you hate but you have to be able to lean into what gives you some satisfaction.
this is the sumatra pdf of images
It's true that drivers might require a bit of fiddling, but if your hardware has been around for a while you'll probably manage.

I'm quite fond of OpenBSD. It's such a nice, wholesome Unix experience. The man-files are great, typically you can get by on those if you mess up and lose Internet connection. To me it has a feeling of being rock solid, like it'll never break. Common programs differ a bit, pkg_add rather than apt/RPM/pacman/&c., you'll probably use pf rather than ufw or iptables, vmm/vmd rather than Docker/jails, flags on some everyday terminal tooling work differently.

Some software just isn't available due to it being considered insecure by the OpenBSD community or its 'dictator for life'. As a C developer you might run into such constraints.
> None of our SPAs use <a> elements for clickable navigation. In fact, most of them attach a click listener to the root element, then let the individual clicks bubble up to there. We use data parameters on the individual elements, and if the click handler sees one of those, then it activates the history state/navigation.

This breaks a lot of navigation features though, right? For example, middle click or control click to open in a new tab, hovering to see where the link will take you, right clicking to save, copy, or share a link, etc.

Why not just have them be anchor elements with hrefs that refer to the URL that you'll be using the history state with? You can still listen to the click events and perform the required history updates and navigation when that occurs, but if the user interacts with that link outside of just clicking it, it'll behave as they expect. Depending on how your navigation works, this could well be less work overall - this has certainly been my experience with similar projects.
Isn't life mostly carbon and water? And needs a bit of oxygen? Seems like the perfect match.
https://news.ycombinator.com/item?id=39878681 was posted a bit earlier and is currently on the front page
CISA had a report on this pretty quickly. I think they refer cases to Secret Service for enforcement. But really, we seemingly have no idea who or where the perpetrator is located. This could easily be a state actor. It could be a lone wolf. And the effects of the attack would be global too, so jurisdiction is tricky. We really have no idea at this point. The personas used to push the commits and push for inclusion were almost certainly fronts. I'm sure github is sifting through a slew of subpoenas right now.
But refinement culture is all about high quality...
There are definitely struggles on both sides of the matter. Regulated sellers have the worst expensive low potency weed. Black market producers can no longer sell at a high premium. The government made these rules knowing it would perpetuate the black market. People want to see the weed they are buying yet sanctioned stores have to have all their products in packaging you can not see through. Edibles have to be of such low potency it is laughable. They stores are selling weed that is 9+ months old. So many issues. Black market guy just selling high quality weed he smokes himself so no he doesn’t put any crazy pesticides or things like that into it. Has to make one wonder why the government made these rules when they serve no purpose other than making a black market viable. But again the struggle is on both sides gone are the days of $2500 a pound. It’s way down.
Maybe they didn't have time to test? They could have been scrambling to make it into timed releases such as Ubuntu 24.04 or Fedora 40.
I am really quite heavily involved in the tech sector, across a lot of domains. I don’t know a soul who runs a BSD variant. How can I expose myself to this arena beyond making a BSD box… which seems like a waste of time at the moment.