skysight-inc/HackerNews huggingface dataset:
I think Google has given up on Fuchsia, outside some specific domains, right?

I think currently even Android, iOS, and ChromeOS have far better security than most desktop and server OSes. I think of the widely-used general purpose OSes, only macOS comes fairly close because it adopted a lot of things from iOS (fully verified boot, sealed system partition, app sandboxing for App Store apps, protected document/download/mail/... directories, etc.).
> ...but since signals are something that is used in a variety of frameworks...

...common usage is not really a justification for putting it into the language standard though. Glancing over the readme I'm not seeing anything that would require changes to the language syntax and can't be implemented in a regular 3rd-party library.

In a couple of years, another fancy technique will make the rounds and make signals look stupid, and then we are left with more legacy baggage in the language that can't be removed because of backwards compatibility (let C++ be a warning).
Richard Feynman tries to improve school textbooks (1985)
I think the link to "nocash" is broken. It should go to: https://problemkaputt.de/fullsnes.htm#snestimingoscillators
Has Justine written anywhere about her disassembly setup?

> I configured Emacs so I can push a button, and the disassembly for the C++ code I'm working on will pop up on the screen in a few milliseconds.

I assume it's something project specific rather than being able to get the disassembly for an arbitrary section of code or something?

It seems very handy, so I'd love to see the implementation (I couldn't find anything googling)
To me this is false. They usually like quick profits. Look no further than Ethereum and defi chains like Optimism,Polygon etc. It is so easy to write a malicious contract that even I with more than 12 years in the cryptocurrency space got had and lost 1k.
You really haven't seen much of S'pore if you identify M'sians as the disadvantaged in S'porean society.

Global labor arbitrage is a huge component in S'pore's economy, so in addition to importing talent for it's more productive industries, S'pore is an attractive destination for less developed SEA and South Asia regions who arrive on a temporary pass for manual labor or domestic labor for a comparatively low wage that translates to comparatively more back home.

A major issue regarding this is these communities' isolation and dependence on their employer during their time in S'pore, with a lack of options or recourse should issues arise.

M'sian nationals, especially Malaysian Chinese, to my perception, typically work the same industries as the citizenry, and seem to be favored for permanent residency and citizenship. The citizenship process is a black box, but it is generally observed that Malaysian Chinese are the most likely and fastest to get citizenship, and it is speculated that it is for reasons of cultural affinity and racial quota.
How about the other Scandinavian countries?
This is another furphy, because OpenSSH proper neither requires nor uses xz/lzma. It's made clear in Andres Freund's original report¹ that the libsystemd dependency dragging it along arises from distros patching openssh to support systemd notifications. The sad part is that systemd notifications are just a datagram on a socket, so using libsystemd for this is reminiscent of Joe Armstrong's banana.

[1] https://seclists.org/oss-sec/2024/q1/268
Yes, but it at the very least delays any findings while you rake in the cash and try to create a favorable environment. OpenAI even stated that think using copyrighted texts is necessary and should be covered by fair use.
This doesn't address the coincidences that the GRU unit is consistently at the place where the "headaches" happen, get identified by the victims, and work with one of the only people (Russian professor) researching the rare disease that was diagnosed for one of the victims. There are documents in the article that link the group with the researcher, which explicitly mentions acoustic non-lethal attacks.
Valgrind will tell you about memory leaks and won't always behave the way it did here when there's a backdoor. In this case it just so happened that valgrind was throwing errors because the stack layout didn't match what the exploit was expecting. Otherwise valgrind would have probably worked without issues.
(author here)

As I wrote

"AI is amazing. I’ve trained an AI to detect model railroad locomotives and their types. I’m a daily user of AI to let it write code for me."

But AI will take away all coding. Sure, some people will write code, like some people today use a mechanical typewriter. Like some artists use clay. But most of what happens in computers in the future will not be code but executed, self modifying, self optimizing, AI models.

"more and more time to think of what I want build"

This is not how AI will work. It's not I want something to build, the AI will just do the things. There will no longer be things to "build". We will no longer think of code as something that exists, but things that just happen.

You will say "But I could tell the AI what film to create, and some scenes, and a rough story, and it will create that film" - but what if AI creates much better, more powerful, exciting, better films than those you could imagine? Films no human ever thought about?

Again, like the typewriter, some people will tell the AI fragments of a story to create a film. But most media content will be created by AI, for consumptions, on the initiative of AIs, not on the initiative of humans.

In the mid 90s I wrote a philosophy paper at university about an AI that generates random images (trigger by my first digital camera, a Olympus C-800L) and then interprets them (making some estimations on the speed it could do that, generation and interpretation). That AI has basically seen it all, an alien killing JFK, me on the moon, you and me drinking a beer, and things we could never imagine.

[Edit] Like there people writing new games for 8bit computers today. They exist, but it's a niche.
Gonna have a serious talk with my mother about not trying to hack into opensource software that powers most of the world's software. I know retirement is boring, but that's no excuse.
I couldn't disagree more, turning temp to zero is like taking a monte carlo method and only using one sample, or a particle filter with only one particle. Takes the entire concept and throws it out of the window so you can have predictability.

LLMs need to probabilistically explore the generation domain to converge on a good result for best performance. Similar issue with people benchmarking models by only having them output one single token (e.g. yes or no) outright, which prevents any real computation from occurring so the results are predictably poor.
They will likely now optimize the code to not trigger high latency and also ensure no Valgrind will find any issues.
Teaching LLMs how to search is probably going to be key to make them hallucinate far less. Most RAG approaches currently use simple vector searches to pull out information. Chat GPT actually is able to run Bing searches. And presumably Gemini uses Google's search. It's fairly clunky and unsophisticated currently.

These searches are still relatively dumb. With LLMs not being half bad at remembering a lot of things, programming simple solutions to problems, etc. a next step could be to make them come up with a query plan to retrieve the information they need to answer a question that is more sophisticated than just calculating a vector for the input, fetching n results and adding those to the context, and calling it a day.

Our ability to Google solutions to problems is inferior to that of an LLM able to generate far more sophisticated, comprehensive, and exhaustive queries against a wide range of databases and sources and filter through the massive amount of information that comes back. We could do it manually but it would take ages. We don't actually need LLMs to know everything there is to know. We just need them be able to know where to look and evaluate what they find in context. Sticking to what they find rather than what they know means their answers are as good as their ability to extract, filter and rank information that is factual and reputable. That means hallucination becomes less of a problem because it can all be tracked back to what they found. We can train them to ask better questions rather than hallucinate better answers.

Having done a lot of traditional search related stuff in the past 20 years, I got really excited about RAG when I first read about it because I realized two things: most people don't actually know a lot but they can learn how to find out (e.g. Googling stuff). And, learning how to find stuff isn't actually that hard.

Most people that use Google don't have a clue how it works. LLMs are actually well equipped to come up with solid plans for finding stuff. They can program, they know about different sources of information and how to access them. They can actually pick apart documentation written for humans and use that to write programs, etc. In other words, giving LLMs better search, which is something I know a bit about, is going to enable them to give better, more balanced answers. We've seen nothing yet.

What I like about this is that it doesn't require a lot of mystical stuff by people who arguably barely understand the emergent properties of LLMs even today. It just requires more system thinking. Smaller LLMs trained to search rather than to know might be better than a bloated know-it-all blob of neurons with the collective knowledge of the world compressed into it. The combination might be really good of course. It would be able to hallucinate theories and then conduct the research needed to validate them.
And if you were behind the wheel, you will be sentenced for driving under influence. Even if it has been days since you smoked a joint.
I don't think this is necessarily true. People do a lot of reverse engineering of proprietary OSes and a lot of vulnerabilities are found that way (besides fuzzing). And the tooling for reverse engineering is only getting better.

Also, let's not forget that this particular backdoor was initially found through behavioral analysis, not by reading the source code. I think Linus' law "given enough eyeballs, all bugs are shallow" has been refuted. Discovering bugs does not scale linearly with eyeballs, you need the right eyeballs. And the right eyeballs are often costly.

If your implicit premise that having the source code available makes it easier to analyze code than closed source, you can also flip the argument around: it is easier for bad actors to find exploitable vulnerabilities because the source code is available.

(Note: I am a staunch supported of FLOSS, but for different reasons, such as empowerment and freedom.)
Some good observations here, including about the apparent acceleration of effort and ensuing sloppiness due to impending changes to systemd that would have prevented the particular attack vector.

Unfortunately, the sarcastic tone starts to become a barrier to separating signal from noise about halfway through. Okay, you’re super clever, the NSA is a threat, too, we get it. Security vendors are largely hucksters, fine. What were we talking about again?
As I understand it, the issue is only about showing up to work with any level of drugs in your system, even if there aren't any actual signs of you being intoxicated.
I believe that overall the decision is a good one, there are no real good reasons why cannabis should be prohibited.

At the same time, I strongly hope that the cannabis smokers will be considerate of the people around them. It is quite a foul smell if you are not partaking yourself.
honestly it looks promising given that a lot of people is going to use it, the AI will learn faster to remove all kinds of ads and unwanted stuff.
Its acceptable for avahi and pulseaudio because you don't need to use them.

With systemd, its a big problem because systemd is widely distributed. Systemd failed on its promise to create a new standard for defining services. Right now a ton of projects ship their own supervisor (runit, supervisord) or docker compose file to reduce their contact surface to systemd. Look what GitLab Omnibus does.

But with everything connected to systemd (udev, dbus), anything without systemd is sort of second class in terms of being tested. Ideally i would have the stability of Debian without the surprises from systemd. I tell people to "Press Ctrl+Alt+Del 7 times within two seconds" way too often.
"... and although the spare wheel is included by default, the car is modular and you can always remove it yourself"

[By dismantling the car completely and reassembling it, since you'd have to rebuild from source...]
Remarks like "work like hell" and ignoring everybody around you make it stand out for the April 1st joke it is, though.
There is one: https://github.com/bolna-ai/bolna
In this kind of thread I always mentionned Circle[0] from Sean Baxter. It's worth a look.

[0] https://www.circle-lang.org/
Here are links to the most recent pull requests sent

https://github.com/ggerganov/llama.cpp/pull/6414
https://github.com/ggerganov/llama.cpp/pull/6412
Yeah, less eyes on it means it would be less likely to be caught, but there's also much more upfront validation on who gets to change it.

Although, I can imagine a sub-sub-contractor identity being somewhat easily forged, it's still harder than just creating a GitHub account.
You remember those fantasies where you got up from your seat at the pub and punched the lights out of this guy for being rude? A lot of us have fantasies of being the all powerful oracle that guides a reboot of civilization using knowledge of science and engineering.
Ah, the date.
Do you remember the Debian openssl flaw? Okay, it's almost 20 years old now, so you may have forgotten, or you could be too young, I don't know. But it was caused by someone attempting to fix an oddity found by valgrind.

https://blogs.fsfe.org/tonnerre/archives/24
Where are searching for old valves? I gave up on rebuilding old fixtures because parts were impossible to find.
This is an easy way that will achieve the goal of completely killing free software, destroying the entire software industry in the process.

I contribute stuff for fun, for free. Now I also have to PAY to do that??? Plus anyone can just steal my identity… I have to show my ID every time I sleep at a hotel. Hundreds of people have a copy of my id and could use it to open an account in my name online…

Do you guys ever read what you write? Did you stop to think about it for more than 0.3 seconds?
Windows 3.1 was pretty light though. It did indeed start up pretty fast because it simply didn't do much. Remember a DOS PC had almost no startup time besides the BIOS Self-Test so there was some expectation to fulfill as well. With 95 and even more so 98 it really started becoming a thing.

The LCD looks amazing though for 1993. Where I lived we didn't see those appear until much later in the 90s and they didn't have that much contrast (they were still very crappy DSTN panels). In 1994 I worked for a computer shop that sold packard bell among others (mainly their own brands) and we didn't have LCDs until much later. I have seen this Philips 150S LCD later but not in 1994. According to ChatGPT the 150S is from 2002 but I can't find a source link so take it with a grain of salt :)

And at work we didn't get LCDs until 2004-2005! At that time I worked in a callcenter and we used to throw stress balls at each other which we had to stop when the LCDs arrived due to an unfortunate accident.
They should be identical except for any debug tools. In fact they should ideally share the exact same root filesystem bit-for-bit, but then you can overlay mount debug tools in place in a dev/staging instance when required.

E.g. if you are running an immutable k8s runtime distro like TalosOS or Metropolis, you can choose to pull and mount a debug container with strace and gdb into the same process namespace of a problem pod, and when you are done all those debugging tools evaporate.

System mutability is why most bugs happen in the first place.

There should be no tools or services in prod except those required to run or monitor prod at runtime.
That is not the norm. You won't get charged for smoking in Copenhagen, but it will put you in a high risk category for smuggling so their typical response here is to search you. They were probably under a high workload and had to prioritize heavily.
You’ve really gotta separate is/ought in your world view.

Is it good to make laws according to taste; ought we do so to help create the world we like?

The problem with the ‘world we like’ is it might not make sense economically - and will fail.

It generally better to allow even playing grounds. Our desires for what what ought to happen are often short sighted.
There are posts on Reddit claiming he resurfaced in Israel and got the shit kicked out of him there. Some people never learn.
That's literally what the German government is doing. They are giving you back the choice, without the threat of punishment.

I get that you're an anarchist or whatever, but repealing prohibition laws shouldn't be something you argue against just because you disagree with the concept of laws as a whole.

That said, if you think that a lawless society would afford you any freedom, you are entirely mistaken.
You know they just ran ldd on sshd and picked one of the results as target right? If it wasn't that it'd have been a different one…
As opposed to inscrutable two-line titles full of the field’s buzzwords on top of papers that you have to parse for hours to realize the idea and results could have been written in one sentence?

Maybe I’ve read too many applied machine learning papers. As long as the funny title isn’t dishonest, I’m all for it.
Imagine wanting people criminally charged over a smell.
Super Fast Rails
The idea is not "valgrind will detect all tomfoolery". The idea here is "if valgrind detects something it may be an indication of tomfoolery.'
> the stack layout didn't match what the exploit was expecting.

What does that mean? Why is the exploit expecting something from the stack layout and why does valgrind complain?
What claims are BS. What did your friends do wrt their vagal nerve
You know that if it hadn't been a library linked by systemd, it would have just been another library right?

Your hastiness to hate on systemd made you forget what we're even talking about…
Actually, “clickbait” doesn’t really apply here, the paper supports the title.
it does but its pretty close.

the best option is just to replace everything buuut that will make you said as well as all your storage will life in network drives
I'd be opposed to legislating against anything just for being "disgusting"; there should be a stronger reason for us to limit each other's personal freedoms. In the specific case of vaping,I understand that secondhand "smoking" is still in issue, so that's the reason to legislate restrictions.
The answer is simple: no such needs ever...

To deploy mainframes, you've most likely spent millions, sometime might even be hundreds of millions. In other words, money is not the problem. So why would someone ever risk getting into huge trouble by reverse engineering or cracking?
For Data-Guzzling AI Companies, the Internet Is Too Small
Github is complicit too. No visual indicators or ways of seeing the comment was edited, just the original comment date.
I would imagine quite a few. It would be prudent to start paying attention to the tools that were created to catch some of the issues(like how people ignore Valgrind errors) as well as commits made to OSS that disables some feature, because it breaks a 3rd party library.

>> odd valgrind complaint in automated testing of postgres

This implies these kinds of complaints are routinely ignored.
I think we can safely say that any taste, smell, sensation or emotion of any importance has been described 1000 times over in the text corpus of GPT. Even though it is fragmented, by sheer volume there is enough signal in the training set, otherwise it would not be able to generate coherent text. In this case I think the map (language) is asymptotically close to the territory (sensations & experience in general).
As many have already pointed out, the library can also be linked to sshd via selinux.
It should be noted that a lot of things are still illegal and are being worked on. Two examples:

You are not allowed to share cannabis.

The amount of THC in your blood that would make it illegal to drive is 1 ng/mL blood serum. This is essentially nothing and can, anecdotally, be triggered by losing weight after consuming.
That is actually a humorous title.

Note that the title accurately describes what the article is about. As opposed to clickbait. Clickbait would have been "You would never believe what we put into graphene!".
I believe it was!
Apologies for throw-away (I'm fasting from HN), but I'm really curious and had to ask- why Polish?
Have you ever wondered that if the group that hallucinates is large enough, maybe it's you that's actually hallucinating?
From what I understand, a few/many of the big frameworks are converging on signals, and another commenter said that Qt had signals in the 90s https://news.ycombinator.com/item?id=39891883. I understand your worries, and I would appreciate some wisdom from non-JS UI people, espcially if they have 20+ years of experience with them.
There could potentially be many things you would not want to commit to git. Binary files and generated files come to mind. There could also be transformations of code for performance or portability reasons. Or ones that require huge third party dependencies that are only used to the build script.

There are many potential reasons to publish a release tarball where some of these steps are already done. It could be done in a reproducible way. Look at sqlite for an example of an extremely well maintained open source library that publishes not one but two source code tarballs for various stages of the build.

These calls to change source code distribution just because it was a small part of the attack vector in this particular case seems misguided to me. It may still be a good idea but only as part of a much larger effort for reproducible builds. In itself it would accomplish nothing, apart from a wake of uncertainty that would only make future attacks easier. Especially in this case, where the maintainer could have acted in a number of other ways, and indeed did. The entirety of the backdoor was added in a regular git commit a long time ago.
Tell me another platform that is free, has realtime chat, voice and video, has stable service, allows sharing images and other media, with good ownership management...

and is open source.

And yes, we've tried Matrix. IRC doesn't speak to people anymore either. Slack is worse.
ohhh. never mentioned.
Software as a Scam
Sounds like a good way to kill off open source entirely. This is luckily unlikely to happen.

As for throwing money at the maintainers, honestly, it’s complicated. A lot of people aren’t doing open source work for the money. Money too often comes with strings, requirements to prioritize what the funder wants to prioritize, pressure to perform consistently, it becomes an actual job.

Not only does this turn off a lot of the types of folks who make the best contributions to these projects, but it bends the priorities toward what would make the most money for the funder. And as this article points out, real security investments often fall by the wayside when profit is involved.

So yes, companies should encourage their workers to contribute to these projects, donate money to the foundations that fund them, hire important maintainers and give them carte blanche to work on open source. But we have to be careful. Making it all completely transactional is directly contradictory to what drives a lot of the contributions.