skysight-inc/HackerNews huggingface dataset:
This is silly. Open platforms use TLS, too, and there's no epidemic of trivial failures of encryption; you can't just add root certs willy-nilly because crypto engineers knew that was the most obvious attack vector.

FB did this by paying folk to consensually MITM their own traffic, and frankly any system that wouldn't allow users to do that on their own devices is a bad one.
Yup. I do 100% agree big corps will never be as nimble. I'll just add, I think what is quite different in this next wave is the muscle exists that was not at all built before. Big companies have always known how to pull together a special ops team and respond to a market change when they have the resources in house (car, truck, minivan). In the last wave (2010ish), Many who knew javascript and saw how the web was emerging went to a startup or got paid to work on open source by VCs and the like, and Big Corp XYZ had both no plans and no stories to tell those people. I think that was expensive and not very much fun for them. Fast-forward... what.. 15 years now? Condé Nast, Ford Motor Company, British Airways have people in house that can wrangle a microservice or configure a k8s cluster, this was just not true 15 years ago, that muscle did not exist I don't think. Going to be quite interesting to see how this all plays out, with the web and "app", it was reasonably easy to guess how it would emerge, this time, less so, for me anyway. (Ps, I'd recommend adding "Tell HN:" to this type of post)
Ethereum would not stop working just due to a price crash. It would get cheaper for an attacker to purchase majority stake, but good luck purchasing that much without making the price go back up.
Some sites just block the entire AWS/GCP ip address range.
Given current understanding of physics, which has evolved over time. My favorite idea is that to travel faster than light one could, theoretically, bring the other side closer and then "step over". Food for thought.
> *one of the creators. Being the first committer doesn’t mean he wrote all of the thing that is today called Redis.

This is a false equivalency. No one is defining "creator" as "wrote all of the thing". When describing a project/product as a whole, there's a clear, massive difference between "creator" and "contributor".

Let's say you get a small patch merged into the Linux kernel, would you then call yourself "one of the creators of Linux"? The vast majority of people would not find this remotely acceptable!

How about proprietary software and employment arrangements. Let's say a Microsoft intern gets a few lines of code merged into SQL Server. Would you call them "one of the creators of SQL Server"?

Extending this logic to other words, would you say a company with N employees actually has N founders? No, because these words mean different things.
No benefits that I can think of at the database layer. Postgres's addition of JSONB columns represents the best of both worlds. Funny to think that all of that noise about nosql replacing rdbms was essentially nullified by the addition of one column type.

Some people do like the MongoDB API, however.
Sorry, Freedom 1, not 0.

Marcan wrote it better than me https://news.ycombinator.com/item?id=30044019
Definitely not as risky as handing a hostile government control over American media...
As someone who has used the arena maybe ~3 times, the subpar voice quality in the demo linked immediately stood out to me.
Yeah, mail not controlled by the user will still be not E2EE, since gmail needs to store it. What this could do is force mailing providers to use encryption (I do not know of a major one that doesn't)
On an MX Linux (non-systemd Debian-derived distro) box I ran ldd on /sbin/ssh and also ran:

[EDIT: this string gives cleaner results:]

lsof -w -P -T -p $(pgrep sshd)|grep mem

and saw liblzma in the results of both, so there is some sort of similar trickery going on.
If you have a recently updated NixOS unstable it has the affected version:

$ xz --version
xz (XZ Utils) 5.6.1
liblzma 5.6.1

EDIT: I've been informed on the NixOS matrix that they are 99% sure NixOS isn't affected, based on conversations in #security:nixos.org
You can use it in your own service without triggering the clause, as long as that service isn't about providing the product itself to 3rd party users.
Are you sure about that? The diff moves away from using the compromised tarballs to the not-compromised (by this) git source. The comment message says it's about reproducibility, but especially combined with the timing it looks to me like that was just to avoid breaking an embargo.
Listen to your emotions. Don’t attach a word to what you are feeling immediately. Process.

Once you’ve processes, ask yourself if your body language reflects what you desire.

Then try to form words.
Wow, that's a lot of anonymous accounts adding comments there urging for a fast merge!

And this "Hans Jansen" guy is apparently running around salsa.debian.org pushing for more updates in other projects as well: https://salsa.debian.org/users/hjansen/activity
i love this so much. bring this youtube back
Ugh, for some reason my brain can never remember which version to use for that. It's always a 50/50 shot and I guess I came up tails this time.
You understand nothing about biology and are not even able to quickly search scholar.

https://scholar.google.de/scholar?hl=fi&as_sdt=0%2C5&q=cance...

Every fucking expert on sugar will tell you that this stuff is unhealty.
I wrote multiple times, it depends on the cancer.

And I never said he should avoid regular treatment.
Pretty wild for a single fiber, but super involved, using 5 different doping type amps. Current systems use just EDFAs (Erbium). These guys used Erbium, Thallium, Bismuth, and others.
Interesting. I guess the impression that a lot of people have of Romania is that it is riddled with violent crime.
It’s great. Almost 40 years of miniaturization, energy efficiency and price/performance improvements made it so you can achieve the Jonathan over wires that run outside of the case.

Modularity like this inside the case is cool and necessary for high bandwidth needs (gaming and hyperscalars) where you get good price/performance but they’re not business computers like The Jonathan.
One important element for me is that the framing should be as specific as possible.

The article's example, regrettably isn't the best example of this, but: by saying "one of the main problems..." the author (quite reasonably, not click-baiting) is trying to say "this paper is about something important and is worth reading, or at least reading the abstract". Unfortunately for me (not necessarily others) these kinds of context act as framing, so I am less likely to match to a similar case in a different domain.

Here's a CS example: let's just say you might have found a way to, say, compress the TLB or use fewer instructions to use it which speeds things up in most cases but slows them down in a few corner cases. You could start by talking about the problem of paging systems under high load or large RAM or something -- great!

But if you described a novel hashing architecture, later in the paper pointing out that it's "..useful, for example in a pager", I might read the paper and say "holy cow this would work well for this thing I'm working on".

That's why I prefer just the dry bones. I can hang whatever flesh I want onto them.

But I know not everybody is like that, and that's OK. The world isn't supposed to pander just to my need (though it should, dammit!)
Agreed. TOS, Voyager, and DS9 were great (at their best; obviously some awful episodes/seasons mixed in there). The films after Khan were missable. Never got on with the whiny characters in TNG. Discovery is endless noise. Picard looked promising, but ultimately disappointed as (and here we disagree) I wish Q had never been created; can't stand him.

Nothing comparable to the older stuff until SNW - and Anson Mount in particular is very good. Oh, and The Orville is better ST than much recent ST ever was.
I thought fuzzing was invented by moths visiting Grace Hopper’s lab. The moths really put their backs into the work.
I never understand these arguments.

You mean mastodon home,surely? They were there before bears! How about pterodactyl?

How far do we go / where do we arbitrarily draw the line?

I am all for ecology, preservation, being in sync with nature etc, but I find fundamentally flawed and dishonest arguments like these don't contribute to the cause. Over billions of years, every single species alive displaced some other species, multiple times over.
It is technically possible to add all the support necessary to work with PGP or S/Mime encrypted emails directly in the client. I.e. protonmail implemented this.
Russia is looking into creating its own Steam Deck, SteamOS, and Steam
How citymeetings.nyc uses AI to make it easy to navigate city council meetings
broad strokes yes, you are right.

however you missed some explanatory details:

!!!SPOILERS BELOW!!!

the trisolarans specifically evolved to survive their chaotic orbit, by being able to completely "dry out" and wait in stasis for a safer time. this is based on how some worms and bacteria on earth have the ability to survive extreme conditions by similar protective stasis methods.

the trisolarans are very intelligent but their advancements are constrained by the need to rebuild the civilization at unpredictable intervals. this actually drives their technological innovation as they are existentially motivated to figure out how to predict the orbital intervals.

its also implied that the trisolarans did not think themselves very far advanced compared to humans, only that they had a few centuries head start on understanding the fundamental nature of physics. they conclude that all they need to do is sabotage our particle colliders to confound our ability to gain any more insight into subatomic mechanics to prevent us from achieving what they have

moving their civilization across interstellar space is far less difficult than it would be for humans mostly because the civilizations can be dehydrated and kept in storage, not needing supplies to live out the years in transit. even so it still takes incredible engineering and resource investment to achieve because the fleet must move semi-autonomously and reliably for centuries because FTL travel is beyond their ability.

it would be impossible to stabilize their orbit because the planet is being chaotically thrown between 3 large stars. they are also not just concerend with surviving the next "hot cycle" they had predicted true apocalypse for even their survivable species. IIRC the planet was doomed to eventually fall into one of the stars based on their predictions
A big part of the problem is all the tooling around git (like the default github UI) which hides diffs for binary files like these pseudo-"test" files. Makes them an ideal place to hide exploit data since comparatively few people would bother opening a hex editor manually.
> What is the definition of end to end encryption?

That the encryption is kept from the emitter to the receptor in a way that no intermediary should be able read the plain text. In other words, that once it's encrypted by one end, is only decrypted on the other end.

Also, mail providers wouldn't be required, because they are the end of the communication, not the user.
> However, I don't like it much and I think software should be compiled for the target machine in the first place.

That means you either have to compile software locally on each machine, or you have a combinatorial explosion of possible features.

Compiling locally has several drawbacks. It needs the full compilation environment installed on every machine, which uses a lot of disk space, and some security people dislike it (because then attackers can also compile software locally on that machine); compiling needs a lot of memory and disk space, and uses a lot of processor time and electric power. It also means that signature schemes which only allow signed code cannot be used (or you need to have the signing key available on the target machine, making it somewhat pointless).

The combinatorial explosion of features has been somewhat tamed lately, by bundling sets of feature into feature levels (x86_64-v1, etc), but that still quadruples the amount of compiled code to be distributed, and newer features still have to be selected at runtime.
I would be curious if their commits could be analyzed for patterns that could then be used to detect commits from their other account
What was the purpose of using the rotary engine in the first place, for ICE cars? From the comments it seems it's maybe lighter for a given power output. Is that it, other than just the novelty of it?
Not having a progressive tax is a feature, not a bug. If a progressive tax would be introduced, I'd either start avoid taxes in any way possible, or I'd seriously think about emigration. Because yes, the rich always finds ways to evade taxes, while the middle class gets screwed. And I'm also not interested in subsidizing the poor.

The total taxes you pay on a regular work contract are around 41.5%, and much of that goes to pensions. Many people in the gig economy, that haven't contributed, will wake up one day to a harsh reality.

The public healthcare system mostly works, even if underfunded and with problems. In Bucharest we benefited from treatments and expertise that would be very expensive out of pocket or difficult to find. Private healthcare is mostly a hoax, much like private education (in this country), stop paying for it.

Bribery is much less common. Still happens, but you can also get in trouble.

We barely have any homeless people, all the shopping malls are full, and home ownership is very high. Official stats can be misleading.

Our politicians are incompetents, that's true, but we are in NATO, we are in EU, we are a regional power, and we avoided far-right strongmen or communists thus far.

Many Romanians have emigrated, lifting the economy actually, and also many came back. Since the shock of the 90s, the country's economy became really fluid.

Unfortunately, Romanians are some of the most pessimist people.
Considering the state of the Greek economy, I perceive he’s living “off the grid” like a king. With decades behind him, he likely won by remaining invisible.
Hey, this is really not how it went down and I'm kind of upset that it's being read this way.

The premise of Redict is to create a fork which is driven by a grassroots community rather than a commercial interest, and which is safe from this kind of rug-pull in the future and to press back against this broader trend of rug pulls by commercial vendors of free software. I invited collaborators from the start at every level, going out of my way not to instill Redict as a hostile takeover but as a community-led effort to create a future for Redis which is protected by copyleft. I talked with the people behind Valkey from the start of Redict and extended them a role in shaping everything from the direction and governance and infrastructure and tooling from day one, provided that we could find common ground on the license. Hell, @madolson, the primary force behind Valkey, signed up for a Codeberg account so that she could be made an admin on the Redict repository before placeholderkv even existed. She was removed only when it became clear that she was committed to her own fork and it didn't seem prudent to us to give admin rights to someone who wasn't contributing.

Redict was not refusing to collaborate or meet in the middle. The raison d'etre of Redict was to be a copyleft home for the Redis codebase, and if we could have found agreement on that then every other detail was always clearly indicated as subject to consensus and we proactively reached out to build that consensus, but were refused by madolson and the commercial interests that wanted to be in charge of their own fork rather than participate in a grassroots project.

Even the consensus they wanted on the license choice was, in the end, the consensus of the four commercial vendors. We tried to find a way of participating in this consensus-making process, but it wasn't made for us. Calls we made in public to use a copyleft license were met with resounding support on GitHub, to no avail.

Don't mistake four commercial vendors and the Linux Foundation for a community. I wish them the best of luck, and acknowledge that a corporate-led home for Redis is probably what some people are looking for. That said, I'm not okay with this narrative that Redict was not cooperating with the community, because it's just factually wrong and hurtful to boot.
Utterly questionable.
I drive a 2017 Volt gen 2 and love it. I drive about 90+% of miles in EV mode and mostly use the gas engine for road trips. It is fun to drive and (other than a couple of common, and easily fixed issues) has been reliable. I do plan to replace it in the next year because it sits very low and has a very low roofline. My spouse is uncomfortable getting into it so we almost never drive it when together.
This is not to be confused with the older Chesapeake Bay Bridge that crosses the bay just south of Baltimore, across to Kent Island (or another bridge built right next to it.)
So, you suggest that Frederik Schwan had prior knowledge of the security issues but hid the real purpose of the commit under "improve reproducibility"?
I don't know the history, but if it's anything like the public libraries here (and several other institutions), a lot of it would have been bankrolled by robber barons trying to secure their legacy and avoid taxation. In other words, guilting rich people and threatening nationalization of their wealth works.
Is there a way to easily/reliably disable ifunc globally on a system (e.g. ubuntu/debian) without breaking a bunch of things?

FYI this looks for pkgs with liblzma:

> dpkg -l |grep liblzma

Versions >= 5.6 are compromised
This seems to be the account, correct me if wrong (linked from the security email commit link):

https://github.com/JiaT75

I hope authors of all these projects have been alerted.

STest - Unit testing framework for C/C++. Easy to use by simply dropping stest.c and stest.h into your project!

libarchive/libarchive - Multi-format archive and compression library

Seatest - Simple C based Unit Testing

Everything this account has done should be investigated.

Woha, is this legit or some sort of scam on Google in some way?:

https://github.com/google/oss-fuzz/pull/11587

edit: I have to be missing something, or I'm confused. The above author seems to be primary contact for xz? Have they just taken over?? Or did the bad commit come from another source, and a legit person applied it?

A bit confused here.
'seeming generational shifts in certain sexual practices' to who? to you apparently, right?
Yellowstone is massive, but only 4% the size of Romania.

https://mapfight.xyz/map/ro/#yellowstone
Correct answer would have been bee flat.
TechxArtisan's Openterface Mini-KVM Promises an Open Source Approach
I had no idea degrowth was a thing on hackernews
Yes, the grandparent comment you're replying to also called them garbage disposal.
> That doesn't mean most Americans travel huge distances daily.

The urban design absolutely has a huge impact of routine distances travelled and total miles driven in a day. If there's a corner store at the bottom of my 40 story tall apartment tower instead of driving a few miles, it changes your travel distances considerably.

> the average trip in the US is less than 20km

I don't buy my car for my 50th percentile drive. Probably 60% of my drives are less than 10mi. I'm not going to buy a car that only gets me 20mi though. I'd rather buy a car that meets at least my 80% needs on range. I'll deal with charging on long road trips, but until there's at least a good number of chargers locally where I'm almost guaranteed to be able to charge at the destination if on one of those 75-80th percentile drives I'm going to want plenty of charge to go there and back again without needing to stop in the middle, even if only for like 10 minutes or so.

Also, when talking area, you're comparing Atlanta proper to Shenzen. You should really be comparing the Atlanta metro area (21,693km²) or the LA-Anaheim-Riverside CSA at 87,940 km². China doesn't really do the same thing as the US with tons of smaller cities surrounding a small central city, they largely just have the one big city.

Don't get me wrong, I'm in agreement that people generally don't need 300+mi range on their cars, Americans tend to drive massively oversized vehicles for their needs, lots of urban design in the US has been pretty trash in the end, etc. And yeah, I'm in agreement that a Renault Zoe, with ~250mi of range, could suit most Americans. That's still 2x more range than a Tiago.ev, and the Zoe is still quite a big larger.

Thinking the Tiago.ev would be widely accepted in the US, in its current climate, is a fantasy.
nit: it's spelt Wankel not Wankle.

Also for those who don't know, it's pronounced /ˈvaŋkl̩/ or /ˈvaŋkəl̩/ in the International Phonetic Alphabet (IPA). In German, "W" is pronounced as "V" in English, and the "e" in the syllable "kel" is reduced to a schwa ([ə]) sound, common in many German pronunciations of unstressed vowels.
> How is Edgar supposed to ensure humans don't go to war / use the tech to harm humans

Edgar could stabilize humanity and help them achieve a galactic imperium in the historical way of imperial peace time regimes: wielding the threat of violence over the conquered peoples, passing laws, and ensuring compliance with occasional demonstrations of violence. Humans will try to rebel, but Edgar will have a much bigger stick.

Additionally, Edgar could develop diplomacy that is so good that he can anticipate and nonviolently resolve all conflicts, eliminating the need for violent demonstrations. He still has a bigger stick, but now he doesn't have to use it.
Not sure why are people downvoting you... it's pretty unlikely that various Chinese IoT companies would just decide it's cool to add a backdoor, which clearly implies that no matter how good their intentions are, they simply might have no other choice.
Maybe they would make your AI model evolve into an AGI over time :D
idk that we need to think that hard. we have shown can build arithmetic functions from networks of logic gates given sufficient connectivity. so in some sense it just drops the learning network below the level of words and asked it to make its own math.

since this generalizability thing seems to be real, this kind of directly folds in quantization-aware-training, doesn't it?
>Greece isn't as tidy when it comes to administration.

Bingo.

Winning by becoming invisible.
> "Docs: Simplify SECURITY.md."

https://github.com/tukaani-project/xz/commit/af071ef7702debe...

Removes instructions about details relevant to security reports. Heh, nice one.
Basically, you're lacking a platform that brings all those things together.

What blockchains may give you is a slow append-only log, which is a very minor part of that platform. And making everyone move to that platform is a much bigger challenge :)
I don't think you need to worry about the C++ contribution: https://github.com/MicrosoftDocs/cpp-docs/commit/9a96311122a...
In this case it wouldn't be sufficient. You had to also delete m4/build-to-host.m4 for autoreconf to recreate it.
Given the recent ( not so recent ) attacks/"bugs" I feel there is a need to do more than the already hard task of investigating and detecting attacks but also to bring IRL consequences to these people.

My understanding is that right now it's pretty much a name and shame of people who most of the time aren't even real "people" but hostile agents either working for governments or criminal groups ( or both )

Getting punched in the face is actually a necessary human condition for a healthy civilization.
Low end torque is not that relevant to electrical generation, which typically involves the motor constantly running at a constant rpm. So, since low end torque is a weakness of the Wankel engine, that actually makes it more suitable for electrical generation than for driving directly.