skysight-inc/HackerNews huggingface dataset:
So this one time, I had a bug report at a client site. The business was largely a member of _______ religion. Our images wouldn't load in the app, but did on the website. How odd I thought, that doesn't make sense! Luckily I was able to be physically present, so I hopped down with laptop in tow, ssh'd into the server and started tailing logs....

Sure enough all the API requests for data were coming through, but whenever a request for image happened - nothing would hit the servers.

What the heck I thought to myself?

I said to the client 'that can't be, that's almost impossible....the only way that's possible is if the SSL traffic is decrypted, inspected, and images blocked from being requested, which, is a MITM attack".

He redirected me to his IT provider. I phoned them up, and explained the situation.

"Ahh so they're _____"

Me: "So what does that have to do with the price of fish?"

Them : "Content filtering..., you need to talk to ____"

Sure as the day is long, the content filter was a VPN all members of ____ had to have on their mobile devices (I don't know how widespread this is, whether it was just this business, or the entire ____ )

I applied to have our system approved, it was, and just like magic the next day photos started coming through.

I'm guessing basically it detected any .jpg/.mp4 etc URL's in https requests and flagged it up and blocked them from being requested. You can be sure on those devices the VPN would have been somehow locked in with device management, and there's no way on gods green earth they were getting at Facebook/insta etc.

So, it's not just meta. That really hammered home how seamless it can be to end users that they really can't trust what's actually happening on their devices.
Runaway saw blade misses man
Made me think how different can be generations and what is countless. I can count back 2 and have not even seen anything about my grandfather who was born 101 years before me (1875). At least I have “signature” as XXX in 1860ies on a plan of farmland from his father, when he bought it out from slavery. And that actual farmland.
Good luck AIng that heritage.
Sadly, this is how it works in many large social systems, left unchecked. The “reasonable consumers” drain the kind contributors until they cannot do this anymore. The curse of kindness strikes in software and other industries alike.
The website should also encourage users to download a copy of their online accounts (Google Takeout, Facebook data, etc). That's a pretty big omission in 2024. I know plenty of people who have been locked out of their own accounts for one reason or another.
As a reviewer, —amend means I need to reread the whole commit to see what changed. A tiny commit means it takes me seconds.

My opinion is that a PR should be small enough that it’s desirable to have it squashed into a single commit at the end anyway.
Coincidentally this landed on my weekly backup day.

Using Time Machine weekly to an external SSD. Also a separate flat monthly archive to another SSD. And just in case that is not enough, rclone my documents and pictures library (everything) to S3 monthly too.

This is restored once a quarter into my spare Mac mini.
Which service do you use? Mullvad?
As someone who has a community who follows my stuff and demands more....

I somewhat get it.

I became the central spot for this particular product. I get occasional emails from people saying the did this same thing, but on a smaller scale. I have scale, so I can do things much bigger than anyone else.

I have a million people using this, vs a startup who has ~100.

(Btw, I'm barely profitable, I was selling to frugal people...)
I don’t know ditto but on maccy it’s just the paste shortcut (for the last copy) plus a number (if you need an older copy). Could it be easier?
ABC?
Second homes, short term rentals, and land banked properties are not available to use as a primary residence but are part of the total housing stock. I call these underutilised properties and suspect that there are more than most suspect.

Demand for purchasing these properties is not the same as demand for homes. That is what is often overlooked when people consider solutions to the accommodation crisis (i.e. usually happy to think no further than 'build more houses' without considering everything that pushes up demand).
> they will aggressively try to remove your property rights from it.... similar to the NYC squatters rights thing.

I think that's bad-faith reading of the quote from one arborist, not the CA Governor or Treasurer or Dept Director of Parks and Recreation.
The way I read the article is that it was implied the state should have considered buying out the owner of the forest (or at least part of it) with state money and convert it to a park. I don't know whether that would have been economically viable and I don't understand people discussing here how forestry policy on redwoods changed after that, but it would be good to see numbers on all this, even
if the answer was no.

FYI Lucasfilm shot the Endor scenes in Del Norte in Apr-May 1982, a year before release of RotJ. So, another huge errorbar would be estimating the film's popularity (if there's a deadline on the property being destroyed, as in this case).

99.999% of movies aren't memorable or profitable like the Star Wars trilogy, so they add no value. Also, this stuff isn't predictable at shooting time before the film's release.
Compare e.g. 'The Matrix Reloaded' (2003) car-chase scenes were filmed in Oakland, but aren't that popular. But also the Boston Public Garden Bench from "Good Will Hunting", a low-budget $10m film by two young guys people had never heard of [0], or the prison location from 'The Shawshank Redemption' (the closed Ohio State Reformatory in Mansfield, OH).

[0]: https://www.livethemovies.com/home/the-boston-public-garden-...
If you need mutability and indexing, then choose GeoPackage. If you can skip mutability, but still need indexing, probably FlatGeoBuffer. If you can skip both indexing and mutability -- then CSV or GeoJSON will suffice (especially if you need small data and human readable).
What makes you say that? I haven't started reverse engineerinng it myself, but from all I have read, people who did have a very good understanding of what it does. They just can't use it themselves, because they would need to have the attacker's private key.
and your ISP will not spy on you?
Demand for tiny city centre apartments collapsed during covid. That’s no surprise and just supports the economic principle of supply and demand
I think you start from a different opinion of what a PR looks like. You say “commits that do one thing”, but in my workplace PRs already are supposed to be small and do one thing: I _want_ them to be squashed into a single atomic commit that’s easy to revert if needed
Simple general purpose uncensored models without any specific dataset are already pretty good with that kind of stuff.
Well, in this case it's even worse. The "community" here in all likelihood was overrun with sock puppets of a malicious state-level actor.
> in general we don't try to batch related objects together except in a coarse form by generation.

It greatly depends on the GC algorithm, right? Copying collectors naturally bunch up related objects (though of course, in which order is less well defined, if one object has multiple pointers to others).
My favorite too
"People"?
Ours is against three walls - you can only access the bed from the foot. It’s also four feet up in the air as we put a closet under the bed.

Turns out you can put on a fitted sheet while you’re on the bed really easily - just lift the head, bending the mattress and the corners in slightly, get the corners on, then off you hop and pull the corners onto the foot - takes 30 seconds at most, and there’s no walking around or lifting the entire mattress.
Not that I'm a fan of it, but in corps it's pretty standard praxis to have a custom root cert installed on all devices and enforce VPN connections on devices outside the network to be able to MITM all requests and do stuff like content filtering (e.g. NSFW, swearwords and obviously malware). It's the company's device and they give it to you for work specific purpose, you shouldn't use it for personal stuff. I don't think it compares to an app that shadily installs its own root cert on an end user's device to spy on them.
IMO, an important part of HN culture that has allowed it to mostly avoid Eternal September is that this is not just a strict news site: old and well-known things can be posted and discussed again, thus introducing them to the newer crowd without making them feel bad about not already knowing something.
I grew up with sheets and blankets in the UK. Can't beat that tucked in feeling.
Is anybody here using Mojo and able to share their experience?
This is why OSS can be more secure. How much software has the build scripts, the code, all of it, locked away and hidden behind propriety software? Instead of lots of eyes, just 2 DEVs?

Yes, this almost succeeded... but can you imagine how many scenarios where someone such as Andres Freund would have found irregularities, but then.. what? Just had to report it to some webpage's contact page? Without being able to even dig further?

Would he have known what was happening, or would it have just ended up as an oddity, with no source code, and with the binary purposefully obscured, and so on?

Or... even worse, it's reported directly to the 2 guy team, and the guy who put the back door in... takes the bug report?!

From where I sit the sleeper/mole problem exists in companies, and can be far harder to detect.
3 letter intelligence agencies.
Interesting; would you have any specific recommendations for an intelligent (high parameter count? Something that can hold a conversation ...), uncensored, specific model that is able to do this?
I have no idea where my wife found them but we have duvets with an opening ⅓ of the way up, ½ the width of the duvet. Means you can’t invert it, instead just the top corners out through the hole, and I usually need to use my teeth as a third hand while I use the others to stuff the duvet in through the hilariously tiny aperture.
Interesting. Could you share a source?
I do a modified version: I put all the corners in the right places, then a good shake by holding two adjacent corners straightens everything out. May not work so well for duvets much wider than your arm span.
> if a certain program compiles, and if so, disable something.

Tiny correction: [...] enable something.

The idea is: If that certain program does not compile it is because something is not available on the system and therefore needs to be disabled.

That dot undermines that logic. The program fails because of a syntax error caused by the dot and not because something is missing.

It is easy to overlook because that dot is tiny and there are many such tests.

I had a similar problem with unit testing of a library. Expected failures need to be tested as well. As an example imagine writing a matrix inversion library. Then you need to verify that you get something like a division by zero error if you invert the zero matrix. You write a unit test for that and by mistake you insert a syntax error. Then you run the unit test and it fails as expected but not in the correct way.

It's subtle. It fails as expected but it fails because of unexpected wrong causes.

The solution: Check the errors carefully!
Debunked where / by whom?
That could be either Mullvad or ProtonVPN.

Both are Swiss zero log, Mullvad has a flat 5 euro/month charge that goes back to when they started to (they say) forever - you can send them cash in envolope for the next twenty years with a generated account number and you're away.

ProtonVPN has plans - the two year streaming sign up is 4.99 euro/month.
Couple years ago there was an outage at Cloudflare and their www.cloudflare.com started pointing to an unrelated 3rd party marketing website, while the dash.cloudflare.com was showing the dashboard.
[dupe]

Lots more discussion on the various aspects of this:

https://news.ycombinator.com/item?id=39832952
Jax vs. PyTorch for fast research prototyping in Multi-GPU environment
Hi y'all. What are your opinions on using jax vs pytorch for fast research prototyping in the context of GPUs in 2024. What are the pros and cons in choosing one over other ?
I bet in the majority of cases, there's no need to pressure for merging.

In a big company it's much easier to slip it in. Code seemingly less relevant for security is often not reviewed by a lot of people. Also, often people don't really care and just sign it off without a closer look.

And when it's merged, no one will ever look at it again, other than with FOSS.
Ours isn’t much better.
Each commit message has a mandatory ticket number you have to enter.
So for details you need to jump to the ticket.

The tickets often don’t have meaningful information in them apart from ‚for details see the attachments‘

Attachments are often either not uploaded or nowadays we do not have read access as they were created by a different team working for a different customer but forwarded to the ‚central backend team’ and for know how protection purposes we are not even allowed to see the attachments.

Effectively resulting in the information that is available telling us: ‚we did stuff‘
Do you think state actors won’t just print out random passports?
In the end you're only pressured as much as you allow yourself to be pressured.

"I don't feel like it, if it's important to you then feel free to fork".

That's really all that's needed. "I don't feel like it" is all the justification you need.

Some guy just made a compression tool, because some people like doing that kind of thing, or because it was useful for him. He didn't ask to be made "critical infrastructure" or to be responsible for the security of sshd or to have some business depend on it, or anything like that. No one even asked him.
As much as I support the privacy of maintainers I do feel like this is necessary to raise the bar for these types of social engineering attacks.

However that would've likely done little to impede this attack if it is backed by organized crime or by a state as is being speculated. It is trivially easy for those types of actors to simply use a stolen identity or create an entirely plausible one out of thin air.
And that leads to the question:

Why do non-friendly state actors (apparently) not detect and eliminate exploits like this one?

Supposedly, they should have the same kind of budgets for code review (or even more, if we combine all budgets of all non-friendly state actors, given the fact that we are talking about open-source code).
Only since 2011. That scandal started long before that
From that thread:

> The choice of MIT is not an arbitrary one

...

> We wanted to encourage the use, modification, and packaging of Redox in absolutely all realms. Open source should be open, for everyone. There’s absolutely no reason for limiting the usage of the software. Therefore, MIT was the license of choice.

...

> We like to have a decentralized structure of the project, allowing people to do whatever they want, no matter how they intend to share it.

Based on their goals, the answer seems to be yes.
Why single out Cloudflare? They are not the only CDN or PaaS with SSL fronting.
I'm working on https://buysimplified.com - streamlines your Amazon shopping experience by curating the badge-awarded products.
Discussion: https://news.ycombinator.com/item?id=39879710
How to Use Docker Build Args and Environment Variables
The new (co-)maintainer was compromised and it would not help to pay him

Depends upon your perspective.

Hacker: "Oh it was hilarious, you should have been there! They donated $1M to the project after I hacked the code, so I took the $1M too."
A similar story in NZ. 0% tax on capital gains when selling a property. There is a so-called 'brightline test' which means that if you hold a property for less than two years or purchase a property with the intention of selling it for a profit you are expected to pay tax on those gains, but in practice this doesn't happen. Still waiting for the day that the tax department gets serious about questioning people's intent (as it is plain to everyone that yield is abysmal and capital gains is the real game - has been for decades).
Very interesting, and I'm always diligent in running backups. The problem I have is that I don't have the facility to store a backup drive (SSD) outside the house. Could I trust a relative? Maybe ... I also looked into renting a safety deposit box, but in the UK at least there are practically no banks doing this now (mainly due to branch closures) and other facilities are too expensive.
Went through many iterations over the years. Arq, restic, borg, tarsnap setting up encryption, incremental backups with cronjobs and all the good stuff.

Some years ago I realized that I value the possibility to restore also for people that are not me higher than the nerd factor and security so I just settled with Backblaze as my main backup and Time Machine for local convenience. Carbon Copy Cloned to just clone my attached drives to my NAS if they are attached.

For me backups are not the place to fiddle around with obscure solutions that nobody in my family would be able to use.
I'd have assumed that using a language server would avoid the need for using something like this, but as a frequent user of ibazel (sort of inotify-watch+make for bazel) I can see how this can be enough to get productive without an editor that fully supports LSP
(anecdata for n=1:) Everyone I personally know who contributed meaningfully to subs I was active in has moved on to other sites. What used to be places sprawling with activity are still places sprawling with activity… but it’s mostly reduced to reposts and posturing and especially posting photos of the thing you bought (I guess consumers can’t do much more).
This has been a trend before the blackouts but it feels like those mark the point where it all broke down.
Using what bank? He used a fake name and a VPN.
I agree that the maintainer doesn’t really owe anything to anyone. Including the so-called consumers on the issue tracker. Furthermore the consumers have no real power over the maintainer; since they aren’t doing anything for them they in turn have nothing to withhold from the maintainer. And they can’t bother the maintainer unless they decide to turn truly vile and evil by doxing and harassing the maintainer. Thus the complaints of these consumers can be completely tuned out.

It follows then that the maintainer can just log off. Because either you believe that the maintainer has some minimal obligation to the community (like a quarterly update about maintainership status or making a notice in the readme if you decide to abandon the project) or you don’t.

But sometimes in these discussions things get muddied because people claim that

1. The maintainer doesn’t owe anything to anyone whatever

2. But she’s a nice gal which means that she will triage some bugs and fix some bugs and explain to a few of the issue reporters that they haven’t encountered a bug they just haven’t installed the program so that PowerShell can find it and

What’s the groans moral angle, here? We’ve already established (1). But what ought the maintainer do for herself? That’s also a moral problem. Are you willing to say that the maintainer ought to log off if they are experiencing burnout? (Again: this is about the moral obligations that the maintainer has to herself only.) Or does that trample on her rights?

And if you are unwilling to say that the maintainer ought to log off, what does that make the maintainer? Are you going to claim that they have (a) started an altruistic hobby by themselves (b) got too caught up in it and (c) are now a victim of circumstance/outside forces because they have no moral obligation to log off? Considering how much power the maintainer has (and how the consumers have none), how is the maintainer a victim of circumstance when the whole enterprise was created by them and can be terminated at will by them?
When it was created, it was a different time. There was a sense of community around open source, much more tightly nit. And the more socially minded you are, the more vulnerable you are to these kind of attacks.
More discussion here https://news.ycombinator.com/item?id=39879710
Such identity checks would also hurt honest contributors who want to hide their identity for other, legitimate reasons.
and folding plastic bags into triangles for storage
even worse, I have Punto switcher that automatically switches language when I start typing. With default config, it changes latin c to russian one because russian language includes word "c" while it's non-sense in English.

and since it's the only Cyrillic character that's placed on the same key as the same-looking english character, I don't even see the problem with my eyes when the autoreplacement fires
I'd disagree, based on reports of the actor trying to get this upstreamed in Debian and Fedora. Widespread net.
This project is backed by our company and will receive ongoing maintenance. We’re also excited to have more Contributors get involved.
Consents are certainly down.

I spoke with someone that helps developers with submissions and interestingly they said they are really busy right now. Turns out though, they aren't busy with new consents but 'minor amendments' - the purpose of which is to reset the 5 year timeframe for the original consent. In other words, they don't want to go ahead right now.
People comparing income multiples in the 80s with today aren’t factoring the increased number of two income families, or even more. In london there are many houses which in the 80s had one income, maybe one and a part time which today have 4 or 5 incomes in a HMO.

Meanwhile empty housing is at very low levels and barely makes a dent (about 1%)

When you have 4 professional adults sharing a 3 bedroom house, there’s a supply shortage.
In JetBrains IDEs: pressing shift twice while some text is selected opens the Find in Files dialog with the selected text already populated.
Jeez man, everyone knows that most Microsoft products with any success are acquisitions. In the cases of Windows NT and C#, they just bought the designers.
The idea is that --amend would be used before pushing the commit that it amends, and so before a reviewer ever sees the original commit.
If somebody searching a good native Mac alternative I strongly recommend this fast open source image viewer (ignore the simple web page, software is great!):

Phoenix Slides

https://blyt.net/phxslides/

It replaced the (abandoneware) Xee3 on my system.
I mean, sure, you could also do “market research” by breaking into people’s homes, reading their mail, and listening in on all their phone calls. I hope some actual criminal prosecution results from this disclosure, as it’s very clearly “hacking” and “wiretapping” and “unauthorized access”.
> People are amazed by hacking, they shouldn't be, its relatively easy if you are a mere 10 year programmer.

+1

Between roughly 1999 and 2013 I was primarily a test engineer for networking switches/routers/telephony products. I found bugs for a living and wrote them up, and in the process I found plenty of security vulnerabilities and wrote them up. Security bugs aren't really that different from other bugs. Yet for some reason we lionize people who find security bugs.

Most security issues are simply quality issues. But by calling them security issues we shift the focus away from the software producer creating shit code to an attacker doing something bad.

The case with xz is a little different, because we have someone who intentionally added bad code and tried to hide it. But for unintentional bugs that rise to security vulnerabilities it's 99% a QA problem.
Your prof is not wrong in theory, but in practice we are failing at 3. plant more trees.