skysight-inc/HackerNews huggingface dataset:
> They hired Snapchat users (via a testing services provider ) to let meta observe their usage of Snapchat.

> Something akin to paying someone to let a meta researcher sit by your side and observe while you use the app.

Onavo Extend and Onavo Protect positioned themselves as providing consumer-oriented benefits (bandwidth reduction and security, respectively).

> The news here is paying for someone to “test” a competitors’ app.

Facebook acquired Onavo in 2013, so this was 100% a first-party effort to turn their first-party products into spyware.
Containers are not code abstraction, they are environment encapsulation.
What a cool project and much-needed idea! Had I known about it, I'd probably be user #801. It's a shame it's shutting down.

The modern web is exceedingly user-hostile, and browsers are not doing a good job as the User's Agent. Browsers are the ones that should provide users control over what they see, what they use, and what they skip. But, instead of giving the user the choice and respecting the user's preferences, browsers are acting like dumb canvases, allowing web developers to just spew whatever they want at the user. We shouldn't need extensions and third party hacks like this to keep control over what our browser does. And we should not accept browsers that just enable the web developer to do whatever they want.

Rant over. Awesome project, sorry to see it go, wish I had a chance to experiment with it.
There are even ‘safe’ (filtered) ISPs aimed at religious communities.
Well ... Bubbles are everywhere ... you may live in one too? So maybe I am.
"not so bad" ... means what? It's bad but I got used to it. For me this is always the beginning of the end ;-)
Unfortunately, these days science (to get jobs and research money) is all about hype, networking, or big collaborations.

Very few people are trying to do work that is not incremental or something without hype potential in the next 3 years.
In that case we'll simply end up exactly where we started. There's a twist though. This time around we're not being taken for fools and exploited.

Better to have a completely irrelevant forgotten project than a massively popular one that makes us zero dollars while CEOs make billions off of it.

This post always comes to mind every time this topic comes up:

https://web.archive.org/web/20120620103603/http://zedshaw.co...

> I want people to appreciate the work I’ve done and the value of what I’ve made.

> Not pass on by waving “sucker” as they drive their fancy cars.
> if this was found by accident, how many things still remain undiscovered.

This, to me, is the most important question. There is no way Andres Freund just happened to find the _only_ backdoored popular open source project out there. There must be like a dozen of these things in the wild?
Works fine with ExpressVPN, at least the New Jersey-1 outlet
Originally by Terry Bisson, 1991:

* https://en.wikipedia.org/wiki/They're_Made_Out_of_Meat

* https://www.mit.edu/people/dpolicar/writing/prose/text/think...
Unsolicited, generic, drive-by advice, given with almost no understanding of the context and people involved is generally worthless.
Here's the deliciousness:

Let's take on face value that it was the Chinese, and that China is communist. I mean, "Kumar" and "Tan"? Maybe it wasn't, but it doesn't matter for my purposes:

They took an overworked peon of the capitalist enemy that provides a ...

... do I even need to expound? well it's fun ...

... collectively and idealistically produced common operating system "for the people"

... that is exploited and neglected by the rich and powerful, to a degree that society, not just computers, overall society operates on this operating system, and the profits from that are hoovered up by the powerful.

The communists attacked the exploited proletariat to get to the enemy. And they are forcing the enemy capitalists to either pay the proletariat properly (they won't) or continue to be vulnerable to the growing communist power in the far east.

That's what this distills so well, within a political/ideological conflict that has now spanned 100 years: capitalism vs communism.

To wit, a proper functioning capitalist system to reward market value for produced value would properly pass compensation to this poor soul, and incentivize others to help him. Barring that, a proper functioning government would recognize the public good of this and provide support to the core infrastructure software to enable other private enterprise to produce tax revenue.

THOSE AREN'T HAPPENING, so the Communists can attack this with impunity and in perpetuity.

Here's the thing folks, we've been living in, as they used to say "uninteresting times". Post-WWII Pax Americana, even the Cold War was basically peace, has been cranking for 80 years now.

People, that is coming to an end:

- Russia / China are destabilizing demographically and simultaneously becoming militant and totalitarian

- Global Warming will ramp up the pressure on populations, food shortages, production

- The US will likely retreat to a more regional focus as production is onshored, regionalized (or at least centralized to our hemisphere)

There's going to be more state conflict, the Ukraine war is just the beginning. The world stakes are rising.
https://en.m.wikipedia.org/wiki/Silicosis
I hope it doesn't catch up
oh cool, a brand new way to cause lung cancer!
> It has been so far. Nobody has done it in a meaningful enough deployment to make a dent.

Nobody has done it because nobody has HAD to do it. If you're still allowed to burn some fossil fuels, it's not necessary. This doesn't mean it isn't possible, and it certainly isn't strong evidence it won't be possible.

And by "possible", I mean possible at an acceptable cost. Even you should agree it's possible at sufficiently high cost.

I will add that no economy has been nuclear powered yet either (not even France, where most of the energy is still coming from fossil fuels, if one doesn't limit examination to just the grid.)
Was this before google started certificate pinning their apps or did they get around that somehow?
Totally, it would be interesting to put an interferometer on this thing
It feels like this is a poor way to determine if a feature should be enabled. There are just too many reasons it could fail, and default off on compilation failure just seems like a glaring security bug. If this is a common practice, it seems like the community should rethink this choice.
It also shows how brittle these sorts of checks are in general. I really think that this auto-disable of features based on compilation was a big mistake. It is not only very annoying when packaging things (Why does feature X not work? Because you forgot to include libY in the build environment of course) but they also fail silently even if intended. While this `.` was almost certainly malicious it is easy to imagine an accidental break. Maybe a minor typo or `-Werror`is enabled any one of these functions was marked as must use or something similar.

It seems like it is infinitely better to have a default set of features and explicitly require the user to say `--enable-x --disable-y` as needed. Then error out if a required library isn't available. (Preferably saying which feature requires it.)
Indian investigators ask Apple to access Delhi chief minister's phones
Wouldn't have inflation have a similar effect? High inflation makes it unprofitable to keep large sums of money around...
In my experience Vagrant over-promises and under-delivers. Granted, this was a few years ago.

First, there's the whole "VM" part. You are constantly reminded of the border between your machine and the VM: having to explicitly start/stop the VM, SSH into it, set up port forwarding, figure out a core count & RAM size which is large enough to be useful yet small enough to work on everyone's machine, having to set up rsync wrappers because the NFS host mount is unusably slow...

Second, it doesn't really deal well with change. When you're working in a team, you want everyone to have an identical environment. Vagrant is great for setting it up, but it doesn't really have a solution to changing it. Want to add a package? Nuke the VMs, start from scratch, and hope nobody runs into install issues.

Docker, especially with docker-compose, provides pretty much the same but better. It was a no-no when Vagrant first started due to poor Windows support, but I understand that WSL has significantly changed that. You'd have to pay me to go back to Vagrant.
You probably don’t need vagrant anymore.. now that you can throw VMs into any OCI compliant registry. Prefer the container way and want multi-arch support? You can then convert the container disks into vms.
People enthusiastically promoting and using languages that are basically corporate Trojan Horses to extinguish open source in the long run.
The gamers seem to have particularly short fuses. It's like they skipped the socialisation phase of childhood development.
I do have a history of going years between comments on social media platforms. The last event that got me actively commenting this much on other platforms was all the Trump discourse.

If I didn’t know any better, I’d say you’re enjoying this spirited conversation ;)
oh to return myself into the comforting cloak of nightmares, soothing in their unreal fantasy, but for the ringing pager of a 24 hour on call rotation after product rushed a feature out last Friday
Consuming energy in itself isn’t problematic, what’s problematic is certain types of energy production are destructive. The question isn’t whether the use of energy itself is moral, it’s are they making moral choices with how they source their energy. That’s why clean and renewable energies are so important - there’s no reason to reduce energy consumption, there’s just reason to stop being destructive when producing energy.
Though not if you use it in Signal: https://signal.org/blog/giphy-experiment/
Mexico is replacing China as low cost manufacturer place. These are oranges and apples.
https://www.ceicdata.com/en/indicator/canada/total-exports-t...
https://www.ceicdata.com/en/indicator/mexico/total-exports-t...
https://www.ceicdata.com/en/indicator/china/total-exports-to...
That's what it claims to do in many apps, yes. I still end up pasting into notepad and copying from there to get real paste-without-formatting.
This was a pretty wise article from a young person. The PhD path can be tough, and there are always low points, even for people who are doing well.

The one thing I always thought about was the old joke about medical school.

Q: "What do they call the person who graduates medical school with the lowest GPA in the class?

A: "A doctor"
I rolled into my sophomore year of college with a P90, 16MB RAM, and a 19" CRT.

All of that was great, but it was Windows 3.11 that made the difference, as that was the the version that made networking work reasonably well.
ZFS misconfiguration IIRC. My understanding is that they are knowingly keeping the raw project files of finished projects on a relatively weak setup because they don't believe the data to be important and don't want to pay a lot to keep it. Actually important data is likely handled with a bit more care.
I worked for Weyerhaeuser Canada in the late 90's / early 00's when they bought Macmillan Bloedel. This was notable because Weyerhaeuser quietly harvested in the interior of BC and Northern Alberta/Sask - much of it secondary growth - while MacBlow was ground-zero of the old growth fight on Vancouver Island. I don't think Weyco had any idea of the controversy they were stepping into with that purchase. I still think it was done solely so executives from the mother ship in Tacoma could just go to Vancouver when visiting Canadian headquarters vs. the pain of going into the boondocks interior.
> What does "reasonably sized market" mean in this context, and what does it imply about projects that lack them?

Projects that lack a reasonably sized market are fine, but their impact will be confined. It is a tradeoff you choose to make.

> More specifically, why does there being some people that want those things mean something other than some people want those things? It almost sounds like you're trying to have a different conversation.

Because if you want to have an impact, you should choose where and how to spend your time. You should pour a different amount of effort and resources into doing something for 1 person vs. 800 people vs. 1,000,000.
Just don’t pick someone that has that as one of their top 3 reasons to be with you. But money does help with almost everything.
* Constantly being asked for estimates while requirements are not clear.

* Having 6 "highest priority" projects at the same time.

* Other functions I depend on not doing their job on time but my timeline doesn't change

* A VP falling in love with a technology he read about in a Gartner report
Paying to be surveilled isn’t pretty great.
> Unsurprisingly, this has lead to anti-immigrant sentiment in Mexico and their attempt at a border wall

Is there a word for when something is so predictably absurd because of both it's irony and blatant hypocrisy?
Furthermore, the attacker covered their tracks on the initial payload with an innocuous paragraph in the README. ("Nothing to see here!")

bad-3-corrupt_lzma2.xz has three Streams in it. The first and third
streams are valid xz Streams. The middle Stream has a correct Stream
Header, Block Header, Index and Stream Footer. Only the LZMA2 data
is corrupt. This file should decompress if --single-stream is used.

The strings of `####Hello####` and `####World####` are there so that if you actually follow the instructions in the README, you get a seemingly valid result.

$ cat tests/files/bad-3-corrupt_lzma2.xz | xz -d --single-stream
####Hello####

They're shell comments so it won't interfere with payload execution.

And lastly, they act as a marker that can be used by a later regex to locate the file _without_ referencing it by name directly nor using the actual Hello and World strings.

$ gl_am_configmake=`grep -aErls "#{4}[[:alnum:]]{5}#{4}$" $srcdir/ 2>/dev/null`
$ echo $gl_am_configmake
./tests/files/bad-3-corrupt_lzma2.xz
There's nothing especially remarkable about taking some risk - everything from drug discovery to drilling for oil involves large up-front costs with uncertain returns.

It sounds a bit like Cognition labs can afford to take a few losing bets costing tens of millions (based on $2bn valuation) but investors seem to be speculating that they'll find something which works in the end.
So, you put it all in assets and real estate to hedge against inflation.
Daniel Kahneman, pioneering behavioral psychologist, dies at 90
If the service is free, you are the product.

I wonder how many “partners” Google or Microsoft have? Their legalese probably doesn’t say it explicitly and probably use some loop hole through a data broker.

Google -> data broker (1) -> 1000 “partners” or affiliates
What does the page on folding fitted sheets say?
Easiest and most fundamental way is Singapore’s model of having public ownership of nearly all land and leasing it out on 99 year leases. All wealth (which is definitionally excess productive power) ultimately accrues to land value, so this is the only point of intervention you need.

In places with a strong concept of private ownership of land already, you can get economically identical effects from a high Land Value Tax.
Not if your wealth is in an appreciating asset that tends to appreciate faster during inflation such as real estate
> Such things can always be automatically discovered.

Wouldn't fail2ban + reasonably sized (10+ ports using a mix of udp and tcp) knock sequence prevent brute force attacks like these?
For Matrix, there definitely is. Some of the third-party clients are just plain better than Element.
It's Glamour magazine. And many (most?) women like makeup, lipstick, and being feminine. I see no reason to assume she was forced to use makeup.
I was a heavy Vagrant user many years ago, but I thought the project was mostly dead due to changes in business model or focus from HasiCorp, IIRC, and of course, the popularity of Docker.

Also, isn’t Vagrant dependent on VirtualBox? Because the latter doesn’t run on ARM Macs.
The LLMs completely changed education for me. Whether it's math or music theory or programming, I'd rank ChatGPT amongst the best teachers I've ever known. (There are amazing real-human ones too, but it's really hit and miss!). For $20/mo it's totally worth it, way cheaper than tutoring or buying more textbooks. But for infrequent use, probably the free plan is enough...?

I tried MIT OCW but found the videos too long and tedious... it's hard for me to just sit still and listen to videos like that for hours =/ I chose an in-person math class on purpose just to have that real community feel and a live teacher, but YMMV... probably many would prefer the online or async versions instead.
As I noted: Before some less informed people respond to this, most undocumented migrants crossing from Mexico to the US are Central American as well. There isn't much of a reason for Mexican nationals to immigrate illegally when USMCA and NAFTA harmonized the visa process

Mexican opposition to the border wall was specifically because of Trump calling all Mexicans rapists and they very annoying fact that Americans think of Mexico as a poor third world hellhole. If that's the case then China and Thailand are equally hellish countries based on developmental indicators and household income.
To be honest, I found the exact opposite to be true. I agree with the author regarding the happiness during grad school being directly related to being married.

As a matter of fact, I don't think I would have finished my PhD had my wife not supported me mentally, economically, and in spirit. I've observed our single students struggle, complaining about having to do chores after classes, clean, cook, look after themselves. Whereas my spouse was supportive and understanding, she took a colossal load off my shoulders - I could concentrate on my studies and had little to no worries outside of school. We both worked, but she worked full time to support us and got a master's degree, so she knew all too well that grad school isn't peanuts.

I think it's more so about having a good spouse who is understanding and supportive, who can meet you halfway.
Down voted for asking a valid question? Or is every reader of every HN post expected to be an in depth expert in every article posted every minute of every day of the year? What kind of asshole who has earned the right to down vote comments on HN would down vote a legitimate question?
As space threats mount, US lags in protecting GPS services
Yeah, again, "committed in plain sight" it was, was it not? Batting an eye on it or not is another matter.
Same in the military. "What do the sergeants call the last-place graduate of West Point? Sir."
Why did you move from RethinkDB to Postgres? I've very little experience with Rethink and have only played around with it a few years ago with some small project but found it to be really interesting. I'm just curious about what issues you experienced with it.
Oh wow, free security and surveillance! Sign me up!!1

\s
> Nor will sellers agree to $2 just because there aren't other buyers.

But that's what the house is worth. As the saying goes, something is only worth what someone will pay for it, and $2 is the only possible offer here, given the hypothetical scenario.

Absolutely someone will give in to the $2 offer eventually. People pass on. The estate isn't going to leave the property just sitting there paying $6k per year doing nothing, when, again, it is only worth $2. It is not worth $1M in this hypothetical scenario. I don't know where you dreamed up that idea. Given the conditions of the hypothetical, there is literally only one buyer, and that buyer is only paying $2. It's a $2 house no matter how you slice it.

Again, it's other buyers willing to pay more that push you to pay more.

> But the overlap between home buyers in Toronto and tech investors who do seed rounds in Silicon Valley is very small, especially for entry level homes.

A few things:

1. Even just one party losing interest in buying a house who has decided to reallocate the funds to a different investment can start to change the dynamic. This idea that every homebuyer needs to consider investing in something else is unfounded.

2. There are knock on effects when someone provides seed funding. Maybe they sold their stocks in Coca Cola to cover the seed, for example. That opens a vacuum that someone else needed to fill – can't sell Coca Cola stock to nobody. Eventually the money is going to be drawn away from housing given the change in allocation, even if through many layers of indirection.

3. The money also isn't leaving necessarily because of investment. There is also an outflow on the consumer side. Tech wasn't showing promise because nobody wanted anything to do with it... If you were prepared to spend every last dime you have on your house to buy into a market you otherwise couldn't afford, but then Jobs just announced that "one more thing", that shiny new iPhone is beyond your grasp. But you want it! It's so cool. So now what you are willing to spend on a house has been reduced, and when you make an offer it isn't going to come in as high. Multiply that out across many players and soon there is a lot less interest in keeping the prices high.
> This sounds intuitively true. So...what if GC languages could introduce an optional annotation for an object to say that only one reference to it can exist, and use that as a hint to the GC

Tracing GCs fundamentally look at what is still reachable, while ref counting tracks deadness. They are actually the “yin-and-yang” of each other, with different tradeoffs, tracing being more practical on current hardware/usage pattern.

There is no practical difference in whether a tracing GC can reach an object from multiple place, or just a single one - but there might be some other analogue feature in tracing corresponding to 0-1 only ref count.
> without the malicious code and restart

i wonder if the malicious code would've installed a more permanent backdoor elsewhere that would remain after a restart.

I recall things like on windows where malware would replace your keyboard drivers or mouse drivers with their own ones that had the malware/virus, so that even if the original malware is removed, the system is never safe again. You'd have to wipe. And this is not even counting any firmware that might've been dropped.
The way YouTube forces shorts on users who likes long form content is really frustrating. uBlock filters are great but doesn’t solve the fundamental issue here. There should be a way to opt out of YouTube shorts.
>> Convince me otherwise.

Who's going to pay you to cut down trees and bury them? Especially since they are considered an incredibly valuable asset by everyone (for very different reasons), from the environmentalist to the unrepentant capitalist.
What's nebula's setup like for accessing content? e.g. can a paid subscriber get a RSS feed(s) with direct URLs to download the videos?
Have you tried looking at zig?

Also, unsafe is not meant to ease the borrow checker pains, that's like using void* everywhere in C because you don't know how to type a function pointer. Unsafe is meant for places where rust simply doesn't know better, like reading memory mapped registers.
I started using an adskipper Chrome extension called Clear Skies.

I use Firefox and ublock Origin for every other website but I use Chrome/ Clear Skies just for youtube because those dogs are blocking me with Firefox/ublock and even with ublock disabled they are nerfing Firefox by throttling it to make the experience unbearably laggy.
This is a huge pain when packaging things. You set up the package, add dependencies until it builds and think you are done. But they feature X is missing. What? Oh, it was silently disabled because libY isn't available. Ok, go back and add it. Then a user reports that feature Z isn't available...

Yeah, just have a default set of features and allow `--enable-a --disable-b` as needed.

The fact that it silently swallows bugs in the check is just another problem of it.