skysight-inc/HackerNews huggingface dataset:
It's important to focus on people, not just code, when suspecting an adversary. Now, I have no idea if this is the right account, and if it has recently been compromised/sold/lost, or if it has always been under the ownership of the person who committed the backdoor. But IF this is indeed the right account, then it's important to block any further commit from it to any project, no matter how innocuous it seems, and to review thoroughly any past commit. For the most security-conscious projects, it would be a good idea to even consider reverting and re-implementing any work coming from this account if it's not fully understood.

An account that has introduced a backdoor is not the same thing as an account who committed a bug.
It was bsd licensed. The code that you received before is still covered by the bsd license. You can pretty much do anything you want with that code except misrepresent yourself as the author.

Public domain isn't the only form of free software. You can literally use it in exactly the same way as you did before. Nothing has been taken away from you.

Does this address your concern?
Search historical documents from the Nuremberg trials
I cut out the middle man with a Zojirushi coffeemaker that brews right into a vacuum-walled carafe. No hotplate to burn the coffee or sizzle the drips when you remove the carafe; brewed coffee stays hot and fresh for hours; can bring the pot to the breakfast table without it going cold.
We didn’t have so much as a sniffle in our house for 2+ years. Masking, distancing, and not going to restaurants—we just did not get sick. Even after the kids went back to school—we had them in a school with heavy-duty air filters in every room and high masking compliance, at the time.

Now we’re sick constantly, it seems. It’s so much worse than before. I think our immune systems are doing some catching up.

[edit] for the timing, we started getting sick a bunch right around the time masking dropped off to near-zero everywhere around us.
I'm talking about in-person complaining as I met a lot of people from those countries and none complained as much as Romanians. And assuming those people don't have internet is just silly.
https://en.wikipedia.org/wiki/Ross_J._Anderson

https://www.cl.cam.ac.uk/~rja14/
Neural networks work, but why they work is not well known. Researchers continue to find new “free lunches” all the time.
What's the opposite side of that though?

That corporate leadership are always paragons of transparency and announce all details accurately, so that business-as-usual markets can correctly price the stock?

Corporate press releases are explicitly crafted to benefit the stock price.

If the content of a negative third party report is accurate, then its intent doesn't matter.

If corporate leadership has a rebuttal, they're welcome to share!

If the content of a third party report is inaccurate, then the company is welcome to sue for libel, I assume?
Ubuntu still ships 5.4.5 on 24.03 (atm).

I did a quick diff of the source (.orig file from packages.ubuntu.com) and the content mostly matched the 5.4.5 github tag except for Changelog and some translation files. It does match the tarball content, though.

So for 5.4.5 the tagged release and download on github differ.

It does change format strings, e.g.

+#: src/xz/args.c:735
+#, fuzzy
+#| msgid "%s: With --format=raw, --suffix=.SUF is required unless writing to stdout"
+msgid "With --format=raw, --suffix=.SUF is required unless writing to stdout"
+msgstr "%s: amb --format=raw, --suffix=.SUF és necessari si no s'escriu a la sortida estàndard"

There is no second argument to that printf for example. I think there is at least a format string injection in the older tarballs.

[Edit] formatting
Yellowstone National Park - 1872

Sequoia National Park - 1890

Yosemite National Park - 1890

Teddy Roosevelt - president from 1901 - 1909
I don't have experience with Qubes in order to know what the files do, but this repo references two files in a qubes directory: e.g. https://github.com/freedomofpress/dangerzone/blob/v0.6.0/qub...
Mainly to swap the Windows and Alt keys, which you can do in System Settings without any additional software.

If you use a mouse with more than right-click and scroll wheel, with side buttons for example, then you’ll need extra software.
Makes you wonder what the agencies know that we don’t…
All the news that's fit to spam
Note the part that even you, an apparently not stupid person, are failing to recognize:

> for purposes of providing the Services to you

It's not about being too stupid. Legalese is very specific, not lay language, and you always should refer to your legal counsel for interpretation.

An example that always comes to mind is "hostile workplace". It has a very, very specific legal definition that is different from a lay understanding of such. It's not hard for pitchforks to be raised when the rabble misinterprets a legal term.

Let's be clear. I'm not saying Vultr has done nothing wrong or hasn't overreached here. I'm only responding to your comment in general terms.
I got one of these "smart" mugs and I will never again by anything that requires an app on my phone. I'm even at a point where I won't install native apps on my phone unless there's a good reason for it to be native, or that it's something I really want.

I've been extremely happy with this $25 USD warming plate[1]. It has good old-fashioned controls on it, so you don't need to install a privacy-invasive and bug-ridden app on your mobile device to use it. Related, I'm very grateful for the Chinese companies producing these types of cheap products. Simple is often the best solution!

I've also really enjoyed this product for keeping cans of soda cold[2].

[1]: https://www.amazon.com/PUSEE-Electric-Gravity-Induction-Sett...

[2]: https://www.amazon.com/gp/product/B08BHHBSHM/
USB solves this, but before USB every serial connection had to be programmed for individually, both for the OS and the firmware of the attachment.

we've solved it now with USB for peripherals, but we only just managed to solve the bandwidth problem for PCI, and we are still unable to attach RAM or CPUs via usb with any sort of performance
Note: the open source version is watered down compared to their commercial offering. Tried both out and the quality doesn’t come close to
I'm sure their lawyers will be looking into it, you probably don't need to be concerned!
The entropy of English is ~1 bit per letter (Measured in a funny way by Shannon - https://cs.stanford.edu/people/eroberts/courses/soco/project...)

In general, it's a bit funny in how we build ML models. You take a bucket of matrices, fill them with random numbers, and then start to introduce "biases" through back propagation. A model can converge down loss, but most of them are still filled with random noise.

Binary weights are somewhat obvious in retrospect. Weights indicate the strength of an association between two neurons. Intuitively, most of the value is probably just that an association between two neurons exists, and whether it's positive or negatively associated.
OpenAI vollies back:

https://twitter.com/OpenAI/status/1773760852153299024
Yeah, I wouldn't necessarily want it to be my own voice either, but it would be very cool to make it be the voice of someone I enjoy listening to. :)
Original title (though I'll allow for some A/B testing):

A.I.-Generated Garbage Is Polluting Our Culture

And here's a gift link:
https://www.nytimes.com/2024/03/29/opinion/ai-internet-x-you...
Bottlerocket vs. Talos Linux
There are a fair number of people who have no issue with what China did and as such it is fair to ask somebody advocating for the same policy if they support China's method.
Or Apple's Swift for that matter. Or Oracle's MySQL or Java. Or more recently Redis.

It has nothing to do with the technical merits of the technology, but with suspicions of the intentions of the company behind it and a desire not to create a dependency on them.
And that's absolutely an argument I will support! and very much do care about.

It's just a fundamentally different argument to "Well clearly, arbitrary species A here at some arbitrary time B is the natural and morally right owner of these lands".
They might have burnt the reputation built for this particular pseudonym but what is stopping them from doing it again? They were clearly in it for the long run.
General speaking: don't use mongodb.

It was super shitty when it came out and using postgres gives you a better and faster solution which you can also use in other projects.

I'm always impressed when I see mongodb still making money.
I don't. I serve static files directly from the nginx.
Yes but it's difficult to justify the immediate loss in income for long term gains
I'd think given enough memory, your files will cache in memory pretty quickly with any server. I usually just use nginx for these use cases or look to a CDN solution.
You’d think its a different time now that the kids who grew up lusting over these cars now have money for one, enough money to create a new car market where even a pickup truck can be almost six figures optioned out
> should SLL decompile to x << y or x << (y % 32)?

I think this a bit of a misguided question. The hardware has a precise semantic defined, usually. QEMU's << behaves similarly to C (undefined behavior for rhs > 32), but this means that the lifter (still QEMU) will account for this and emit code preserving the semantics.

tl;dr: the code we emit should do the right thing depending on what the original instruction did, without making assumptions on what happens in case of C undefined behaviors.

> Ghidra's type system lacks function pointer types

Weird limitation, we support those.

> it doesn't seem to understand stack slot reuse

That's a tricky one. We're now re-designing certain parts of the pipeline to enable LLVM to promote stack accesses to SSA values, which basically solves the stack slot reuse.
This is probably one of the most important features experienced reversers ask for.

> that language need not be C--

Making up your own language is temptation one should resist.

Anyway, we're rewriting our backend using an MLIR dialect (we call it clift) which targets C but should be good enough to emit something "similar to C but slightly different". It might make sense to have a different backend there. But a "standard C" backend has to be the first use case.

We thought about emitting C++, it would make our life simpler. But I think targeting non-C as the first and foremost backend would be a mistake.

Also, a Python backend would be cool.

> Analysis necessarily involves...

I would be interested in discussing more what exactly you mean here. Why don't you join our discord server?

> I'd absolutely love to be able to import C++ header files to fill in known structure types

We have a project for importing from header files. Basically we want use a compiler to turn them into DWARF debug symbols and then import those.
Not too hard.
A project is underway to add a 2nd tunnel using a tunnel border. This increases the effective width from one to two lanes of traffic in each direction; four total lanes between the two tunnels. The borer moves 50-60 feet per day; at this rate they expect to finish the boring process in a year.

https://www.cbbt.com/tunnel-project/
If they hadn't been modifying SSH their users would never have been hit by this backdoor. Of course if it is actually intended to target SSH on Debian systems, the attacker would likely have picked a different dependency. But adding dependencies like Debian did here means that those dependencies aren't getting reviewed by the original authors. For security-critical software like OpenSSH such unaudited dependencies are prime targets for attacks like this.
Sure, regulations and legal systems are important. However, they can fail to protect people in situations where technology would offer greater protection and vice-versa.

For example, Benjamin Franklin applied his technical skill as a publisher to engineer dollars that were more difficult to counterfeit. The illegality of counterfeiting on its own could not prevent counterfeiting, so technology was also availed.

It’s critical for us to recognize that technology is a critical component to our security, not merely an alternative to regulation.
Please do this in France too. So much land, but agriculture everywhere.
They appear to have moved carefully to set this up over the course of weeks by setting up the framework to perform this attack.

I would now presume this person to be a hostile actor and their contributions anywhere and everywhere must be audited. I would not wait for them to cry 'but my bother did it', because an actual malicious actor would say the same thing. The 'mob' should be pouring over everything they've touched.

Audit now and audit aggressively.
A "real life" example of this can be found in the Ironclad cryptography library [0]. It uses this to add support for AES instructions and some other niche assembly instructions to generate fast (at least a lot faster than it would have been) cryptography code.

https://github.com/sharplispers/ironclad/blob/master/src/opt...
Zion (the parts people see, at least), is tiny by comparison.

Also, as a photographer, the shuttle system is pretty awful. It's no longer easily possible to do get out to where you want to be well before dawn.
Yes, this exact reason is why I'm not using UPX either. But it is useful when the conversations eventually devolve into binary size golfing ;) (ironic, I think NativeAOT does really well as of .NET 8 in this department).

I'm curious, what are the dependencies of that said Go program for it to take 100 MiB? Can't imagine a .NET (AOT or trimmed self-contained JIT) binary taking this much unless it is a GUI application.
> could be the one to roll their own silicon and put an LLM in our back pockets.

Wouldn't they have to do a lot of catching up with everyone else already working on it?
Actually they plan to put an LLM in your back pocket using flash memory, not silicon: https://arxiv.org/abs/2312.11514
He came way later - it began much earlier: https://en.wikipedia.org/wiki/History_of_the_National_Park_S...

You have to look at the history of each individual park, some started out as government land and remained such, others were private resort islands, etc.
Viable fusion will need breeder reactors for tritium?

"Old fission" isn't technically a viable economic power system anymore, at least in its current forms. Solar/Wind are so cheap, and still getting percentages cheaper each year, that it gets harder and harder for other forms of power to compete.

Even combined cycle natural gas turbine with downstream heat recapture to exceed Carnot efficiency limits can't compete with wind/solar.

I get what you mean about viable fusion in just sustaining a energy-positive reaction. But even if that is achieved, fusion will likely not be economically viable outside of industrial high-heat constant-load applications (which there are a lot of, fission should be able to handle those but the waste and proliferation concerns are a real barrier).

If there are breeder reactors needed for fuel ... forget viable grid fusion power.
Maybe not. They removed safe_fprintf() here and replaced it with the (unsafe) fprintf().

https://github.com/libarchive/libarchive/commit/e37efc16c866...
One of Jia Tan's recent contributions is "Speed up CRC32 calculation on LoongArch" I would guess the odds are that this is not someone in the US.
This theory is debunked by the two books, written by two different historians, which go into it in great detail.

The second bomb made it clear that the first one was not a one-off, and that the US was going to nuke the cities one by one. The Japanese also had intelligence (that turned out to be false) that Tokyo was the next target.

I've read a couple accounts by anti-nuclear activists who held that the USSR was the reason for the surrender, but if you compare those accounts with the ones written by historians, the former are crackpots.

An invasion of Japan would be an absolutely massive operation (see D-Day) and the USSR was in no position to mount one.
Roosevelt's Time Machine was well known.
Show HN: Live-Streaming Next Week's Solar Eclipse from Above the Clouds
Hi HN,

I've been working on a high altitude balloon along with a team of volunteers that is going to take pictures during the solar eclipse next week. The balloon has a gimballed camera (or more accurately, a gimballed mirror) that autonomously tracks the sun. Real-time video is sent down to the ground via 70cm ham radio. The comms was developed almost entirely by myself, and on previous flights we've tested it to a range of 140km. Along with the real-time video, it also uses spare bandwidth to send down high resolution imagery from several other cameras on the payload.

We'll be streaming the video to Youtube. Our channel is linked on our website. If you're not going to be in the path of the eclipse, this is a great way to participate. And even if you are in the path, this gives you a second opportunity to view it - we'll be launching from New Brunswick, Canada, which is one of the last places the eclipse will pass through.

Aside from the project website, I also wrote up a short article on one of our previous launches. It focuses primarily on the communications system since that's my contribution to the project: https://www.scd31.com/posts/real-time-balloon-video

I hope you like it, and I hope to hear your thoughts. Thanks!
> A well made thermos (like my zojirushi) will keep stuff cool for more than one day. And coffee hot from dawn till dusk. No batteries or cables required.

As pointed out in the introduction of the article, this is not the same use-case; there are some types of coffee or tea that require specific infusion temperature and duration, something you can’t do with a normal mug or a thermos.

You can however prepare them using a thermometer, you don’t need a "smart" mug.
Imagine a more competent backdoor attempt on xz(1)—one that wouldn't have been noticed this quickly. xz is everywhere. They could pull off a "reflections on trusting trust": an xz which selectively modifies a tiny subset of the files it sees, like .tar.xz software tarballs underlying certain build processes. Not source code tarballs (someone might notice)—tarballs distributing pre-compiled binaries.

edit to add: Arch Linux' entire package system used to run on .tar.xz binaries (they switched to Zstd a few years ago [0]).

[0] https://news.ycombinator.com/item?id=19478171 ("Arch Linux propose changing compression method from xz to zstd (archlinux.org)")
I think he's just saying that if you move in somewhere where there were lots of bears.... don't be surprised when bears show up and are annoying.
I wrote a macOS app to save the movements of your own AirTags and iPhones
While I’d probably vote to shoo the bears, I don’t think the argument is particularly hard to understand.

Like the folks who build their house at the bottom of a flood plain or fire area and then demand help for ensuing disaster.
Apologies, I intended incapacitation as not unconsciousness, but finding a narrowly-tailored way to prevent the offender from re-committing the crime, in order to protect society. Ultimately, rehabilitation is the answer on how to do that, but until rehabilitation is completed, some manner of incapacitation or restriction is necessary.

I don't know enough about SBF's crime, which is very complex. But for white collar crime in general that isn't wanton indiscriminate violence, imprisonment seems like it is inherently punitive and thus wasteful, unless it's in a place that is highly focused on rehabilitation (education, therapy, etc).
OpenAI Unveils A.I. Technology That Recreates Human Voices
It was a joke. I didn’t know that about Hamilton, though.

In case her work interests you, I did get their book on Higher Order Software where she applied everything they learned. The method was like executable specifications with code generators. The specs were reminiscient of Prolog and CSP mixed together. Later, it became USL in the 001 Toolkit. It and her other papers are on htius.com.

I didn’t think HOS/USL was practical. Her team’s early work was really impressive, though. I also still respect everyone that tried to achieve the hard goal of formally-specified, bug-proof software. Each attempt teaches us lessons.
Maybe Americans should tame their Elites into like not destroying Republic abroad and not fund genocidal maniacs. Heard it helps not having governments being hostile towards yours.
"it does not matter who measures"
> so now security-critical daemons like openssh have additional dependencies like liblzma

Systemd itself seems security-critical to me. Would removing other dependencies on libsystemd really make a secure system where systemd was compromised through its library?
OpenAI Voice Engine - Blog Post
Still ranks #7 on TTS Arena, however.
Yeah, I can't conceptualize how this mug is supposed to work especially at the speed it claims.

It seems like it would just muddle the temperature down to mildly above room temperature over multiple minutes. So that the drink and material are the same temperature but the material holds heat due to being insulated on one side. What this would mean is the mug would get less effective as you drink more.

The insulated mug would make the time longer but it is no where near something like the Ember that converts electricity to heat.

Seems like KS schlock for people that don't want to think about if / how it works.
It's just cryptography and encoding. Popcount is useful for understanding entropy.
Thank you! Minor clarification, for performance ceiling I was wondering about for serial (not parallel)
Trust me, I had my regrets in noting this as a dupe, but HN's guideline is that unless there's "significant new information", submissions substantially similar in theme, regardless of whether they're the same or a different URL (within a year of a prior posting with significant discussion) get buried. See: <https://news.ycombinator.com/item?id=9716270>

A big part of the concern is duplicate discussions: <https://news.ycombinator.com/item?id=27028471>

I'll occasionally gather up related links when a large news story hits and post those to the first / main discussion.
I read a non-fiction book by Frank Abagnale (inspiration for Catch Me If You Can) about common forms of fraud, and it's remarkable how often people are caught embezzling because they do something dumb like buy a flashy car that attracts attention from coworkers. Embezzling in the pre-computer age was pretty easy to get away with if you would just avoid drawing attention to yourself, but people just can't help it.
The balance of the impact across weight and driving style isn’t necessarily clear…
Started reading the article, and got lost on the basic coffee physics.

The author's data appears to be a near exact fit to a*x^b+c with a=247.6 deg F, b=-0.453, and c = 48.1 deg F with R2 = 0.999.

Kinda weird, since 48.1 deg F is an odd asymptotic approach. However, it does take 1000 minutes to get below a normal room temperature (65?).

Implies that the ideal serving time from the author's prep method is approximately: ~3.75-4 minutes for a serving temperature of 185 deg F, with drinking and consumption perhaps 5 minutes afterward.

From this article: https://www.researchgate.net/profile/Nhan-Pham-Phuoc/publica...

135 deg F does seem to be a reasonable choice for consumption, as it's the range where coffee caffeine extraction has mostly halted in the coffee grounds.

Also, at least the author's honest, that it seems silly even your coffee mug has an "app" these days.
$ dpkg-query -W liblzma5

liblzma5:amd64 5.4.1-0.2
who said vitamin C? NOT ME... don't put words into my mouth?
it's actually not even the most common preservative that is added to our foods...

sodium benzoate might be the most common one... which they say is considered safe in small doses because they want to save money by extending shelf life.