skysight-inc/HackerNews huggingface dataset:
I wonder whether the same problem would occur with enough focus on what any one of us says?

If we recorded your words over a period of a few years and then had thousands of people looking for errors in the transcripts, what errors would be found in your memory or thinking patterns?

It is certainly common enough to see some doozy mistakes from smart people within the comments on HN.
Because they deserve to get broken.
Right, I understand now, you are talking about transmission losses.

And using units of resistance is a way of talking about the loss independently of the amount of power transmitted.

Although, I think your original statement I quoted, is omitting some information you are relying on – e.g. how much energy is "$265 billion of aluminium", and so how much energy are we talking about such that 1 ohm transmission loss would amount to that
so this backdoor is a package which installs a fake sshd? what is selinux for?
I don't know that they had a singular target necessarily. Much like Solarwinds, they could take their pick of thousands of targets if this had gone undetected.
An http proxy would need to be configured cleverly enough to serve its own acme challenges directly, and proxy any requests for the backend’s acme challenges. Which is I think the trick that was missed by the tailscale setup.
Lightspeed VC Paul Murphy calls for ceasefire now
This attitude is how we get streaming music players that consume in excess of 1 GiB of RAM.

Performant code needn’t be unclean; it’s just often using deeper parts of the language.

I have a small project that became absolute spaghetti. I rewrote it to be modular, using lots of classes, inheritance, etc. It was then slower, but eminently more maintainable and extensible. I’m addressing that by using more advanced features of the language (Python), like MemoryView for IPC between the C libraries it calls. I don’t consider this unclean, but it’s certainly not something you’re likely to find on a Medium article or Twitter take.

I value performant code above nearly everything else. I’m doing this for me, there are no other maintainers, and it’s what I enjoy. You’re welcome to prioritize something else in your projects, but it doesn’t make other viewpoints objectively worse.
IrfanView has a nice feature where it can monitor a folder and always show the newest picture. I used that for a selfie-photo-station for my wedding. A little more details here: https://news.ycombinator.com/item?id=37219826

Another feature I use often ist to copy the current image to a preset location. I use that for quickly pre-sorting photos.
However only probabilistic detection is possible that way and really 100us variance over the internet would require many many detection attempts to discern.
FPS Controller Design and Build [video]
The headline seems like a distinction without a difference. Bypassing ssh auth means getting a root shell. There is no significant difference between that and running system(). At most maybe system() has less logging.
> nor is it more generally predictable

Can you explain what you mean here? This does not match my experience or intuition.
The Codemanship TDD book [pdf]
If any of Thomas Edison's peers could've made 2024 era white LEDs, nobody would have bothered with incandescent.

Even in the 1980s and 1990s when I was a kid, having half a dozen 100 watt bulbs on around the house would have been a significant fraction of the overall electricity bill.

The first time I got an LED based bike light, I finally found that I could get oncoming cars to dip their full-beams instead of dazzling me when they went past.

> We used to have more or less "additive" technologies. A new one would go add to the list of available technologies, not really fully replacing any.

Zeppelins.

Gas street lights.

Pony express.

Asbestos.
Very possible outcome for OP too.

The weakest part is usually the human factor and the need to bucket someone into a few categories like "rock star" or "loser" or "slightly better than unskilled labor" or "nerd engineer".

Have been in a similar situation and sadly found unless your peers have truly understood what you've done and how, they'll filter your suggestions or insight through whatever bucket they've placed you in.
There are lots of people who do think that way. You never hear about them again. You only hear about the minority who do take another swing.

Also, who’s to say she doesn’t “admit it”.

She can acknowledge her fortunate circumstances while still deciding she wants to spend her future building another company which may or may not succed
Not only am I going to try this, I think it’s a YouTube sensation in the making
When ACDsee got bloated (and the shareware screen to nagging) I switched to IrfanView.
Tuatha Dé Danann
Creative Types and Management Types
> you cannot by any strategy make money on betting on the outcomes

What does "strategy" mean here? I might just happen to have a strategy which involves betting on the exact sequence of heads and tails in a given sequence. The analogy in terms of languages is that my language might just happen to have a short keyword that represents a given sequence of heads and tails.

I don't know much about Kolmogorow complexity so I'm certainly missing something here. Potentially there is a subtle clause in the technical definition that doesn't make it through to these articles.
Just listened to a podcast today with a focus on the Ontario budget, but they do discuss how this pattern is the norm for most, if not not all, provincial governments too. (1)

It's like governing is the end goal and not a means for the political class, so we end up with crummy policy across the board.

(1) https://thehub.ca/2024-03-29/this-government-is-oblivious-th...
Culture Talk
The obvious cynicism aside, what you said doesn’t really contradict point #1. All those responsibilities can be taken by any IC in pre-seed/seed startups (except the wrongly stated “most important person on the company”).
If you want to go back to IC role, that should not be a problem anywhere really.

If you are tired of "all the responsibilities, management, etc" then you will probably not follow that path anymore, you tried and it's not for you.

However, if you ever decide to follow that path again, be advised, boards/founders want to hire C-level people who have a proven track of building successful organizations through good and bad times. Having even a single occurence that signals you were "tired of all the responsibilities, management, etc" will disqualify you.
>- If the issue was ipv6 configuration breaking automated cert renewals for ipv4, wouldn't they have hit this like.. a long time ago? Did I miss something her

AIUI, they switched to their current setup 90 days prior to the outage. The initial cert they installed during their migration lasted 90 days. So 90 days after the migration, they had an outage.
Running an LLM Locally on your machine
It's way simpler. Seccomp is a pita to keep current and complete. Landlock is higher level with concepts of filesystem locations rather than basic low level ops.
I found this part interesting:

> It turns out this isn't because of something that Rust is actively doing incorrectly: layout of primitives comes from the LLVM codegen backend used by both Rust and Clang, among other languages, and it has the alignment for i128 hardcoded to 8 bytes.

> Clang uses the correct alignment only because of a workaround, where the alignment is manually set to 16 bytes before handing the type to LLVM. This fixes the layout issue but has been the source of some other minor problems.

For some reason, my mental model of clang and LLVM was that the projects were essentially being worked on by the same group of people, although I'm realizing now that I have no actual knowledge that indicates this is the case other than knowing that clang was the first place I had heard of LLVM from. The fact that an issue could be in LLVM but is partially worked around in clang raises several questions for me:

1. Was this considered a bug by the LLVM developers when it was initially worked around in clang?
2. Would the developers of clang who added the workaround have been able to directly commit a fix in LLVM at the time?
3. When an issue is worked around in the compiler for one LLVM-bas3d language, is there any formal or inform but ongoing communication channels that the developers can use to tell developers of other LLVM-based language in case they also need to work around this?

I'm asking these questions because I don't actually know the answers to them, not to try to make a point. My immediate instinct when hearing that clang worked around this issue but Rust didn't is to think that there either must have been some reason why Rust couldn't (or wouldn't) work around it immediately or that the Rust compiler developers weren't aware of the issue. It's possible that I didn't understand part of the article that answered which of these cases occurred, but I didn't come away from reading it with confidence that I understand fully why 128-bit integers have had this issue for so long (since they were stabilized several years ago if I remember correctly).
It’s “medium term” objects that cause all the trouble. Async operations. That’s why .net invested heavily into zero-alloc tasks, as the gc would kill scaling in async heavy code.
Sure modern Mac/Windows/Linux system files with browser cache. Code+data files after build. This is enough to never find out about those 100 bytes.

Not to mention hardware backdoors in chips. Have all trillions of transistors and their schematics in each chip version been checked for possible backdoors in the Verilog compiler? One extra connection can provide root access and cost millions of dollars.
I was at my parent's house and turned on a bathroom light which popped and startled me. I was very worried about some electrical fault that might be dangerous. It turns out it was a quite old incandescent light (probably the last one in their house) that had simply died. I forgot that they did that because I haven't replaced a bulb in literal years.
I'm not asserting that what I've proposed is all that should be done, and my post was not meant to be exhaustive, just offering some extra DiD tips when it comes to hashing, salting. My suggestions are to mitigate the impact of precomputed lookup tables, forcing adversaries to crack the hashes themselves, and offering defenders a slight information advantage in circumstances where an adversary gets access to a database, but not source code, which really isn't that obscure or unusual of a situation.
Kara Nisan Operation
242 websites were hacked by Yabgu Fatih Şah

https://spyhackerz.org/forum/threads/kara-nisan-operasyonu-2...
But if you’re comparing it to other VPNs and only need VPN the pricing is bonkers.
Sure there are trade offs. If a significant part of the value of the app rely on data sharing or transactions between customers this is clearly unfeasible. But if the app mostly deals with a significant amount of private data of the customers that occasionally needs to be shared, I think using separate databases (not servers) is the safest option.
And risk discovery by the trustworthy developer? Unlikely.
A side question: is this taught in CS curriculum you know? It was at my uni (fairly good one, in a minor European country), and this experience biases me because I assume every CS knows Kolmogorov complexity.
Novo Nordisk facing pressure as study finds $1k drug can be made for $5
Wow

https://ubuntu.com/security/notices/USN-5378-2
> start by taking on voluntary leadership roles such as mentorship, or running initiatives within your company (setting up an informal team to codify source code management practices, that kind of thing).

This I have been successful with at multiple companies. Often bringing a complete shift in development practices / headcount allocation strategies. I've setup multiple teams and initiatives at my current FAANG employer as an L3/L4. My most recent one was a library which is being used by extremely high priority projects with VP-level visibility.

> Make sure your own management know that you are interested in this path.

This is where I have been extremely unsuccessful. I explained that at some point in the future I wanted to be at the Director or VP level. One of the higher level employees that I was discussing this with laughed at me (she also did the same about my library and other initiatives only later to applaud when our VP thanked me for landing them).

My manager and skip level manager are advising to "take your time" and "you may not actually want that" and similar things. They say to focus on L+1 which I do understand as a priority but what I am really trying to communicate is:

1. Long term I'd like to be higher level leadership

2. I don't know if the skills I am learning right now will put me on this path

3. I want to in the short term work on high impact projects and in the long term build the muscles needed so that when I say "I'd like to be a director" no one laughs at those ambitions
too verbose probably, factoring in tokens cost
I saw gitorious being mentioned in the comments and want to second that. The article missing that gitorious was the sleeker looking and most promising second contender after github until it was aquired and shutdown by gitlab seems odd. It still baffles me that gitlab never managed to make their product look or feel even half decent. Whoever will challenge github will look and feel more human and more like home not less.
Yes but except in remote areas or with specific natural features, where you can't get to other people easily, having a phone not cut for days is not critical enough that it justify maintaining a whole parallel infrastructure.

You may argue it does, but it's easy to figure out: in my country you can get it in some places, but it's an expensive premium.

Very few people do. Which mean they don't value it as much as they say they do. The ones that do usually are the ones that have the need to be able to call health institutions in emergency.

Turns out humanity survives very well without a phone, and while I get how it can become a big problem for an individual, on average for the whole society, it doesn't balance out.
Why have you wasted 80% of the die?
Thinking about this more: maybe there would be some benefit to GitHub taking control of "release" repositories that may only be written to be GA. They'd write everything -- maybe as a docker image -- so anyone could pull down the image and compare shas, or whatever. And maybe this could also be done by their competitors. The ultimate goal would be to have multiple trusted parties performing the build on the same code producing the same output, and allowing any randos to do the same.

If the source is included in those images, we could conceivably prove that the target was based on the source.

It's not nice and easy, true.
“I don’t want to infer types from my code. I’d rather infer the code from the types.”

Ditto.

The world where data and it’s type is the SSOT means you can trivially validate every bit of code that touches it.
I'd be interested to see what Amazon's actual costs were on that bill.

Their overall operating margins are around 30%, but it would be interesting to see the cost / revenue line items on a bill like this one.
> Bypassing ssh auth means getting a root shell

Only if you're allowed to login as root, which is definitely not the case everywhere.
Another way to use git to debug - albeit more tedious - is to manually check out branches (using a binary search) until you find the exact change that caused an issue. This is helpful if you have no idea what part of the code is causing a problem, but you know the problem didn't exist a month ago. Performance issues are a good example.
Note the date there, that's 12 years old.

The first answer

> Better is coming.
> Better costs money.

Better is here, better doesn't cost more money (anymore).

It's pretty trivial to find a warm LED [1], just look for something with a temperature of 2700K or lower and you are set.

In fact, I have a bulb with that color from about that time still operating today.

[1] https://www.amazon.com/s?k=2700k+led+light+bulbs&crid=IYEGTJ...
That's not true at all. Nakba was an ethnic cleansing of over 750,000 Palestinians. Voluntary Jewish immigration at behest of Zionist urging to Israel is not the same thing.
I don't think it's really a question of humility. it's more about placing the highest value on the functioning of the team. once your overriding goal is 'not looking bad', and 'escaping blame', that goal, which should be primary gets completely lost.
I imagine such actors are embed within major consumer tech teams, too: Twitter, TikTok, Chrome, Snap, WhatsApp, Instagram... covers ~70% of all humanity.
i was right; LLM needs two major components added before we can swan dive into humanistic aspect of medicine/pyschology/politics using a form of LLM.

1) weighting of each statement for probability of correctness and

2) citation for each source.
Please note that this Forbes author in particular seems to have a vendetta against Stability AI and has been publishing hit pieces for months now.
That's fair. I guess if you just need a VPN, it doesn't really make sense to consider a product that packs all of these VPN-adjacent features. But part of my point was how much you're able to do on Tailscale for free, so in that regard, the pricing really doesn't seem as bonkers to me, to be honest. The $6/month tier is also incredibly reasonable for unlimited users, but it is annoying, I'll grant, that they actually drop some ACL features from Free tier to Starter. I suppose that's how they funnel a large number of enterprises from considering Starter in favor of Premium. But if you actually make use of the feature set of the platform, which if you have a decent DevOps team I'm pretty sure there's tools in there that they'll love, then $18/User/month actually doesn't seem too outrageous to me.
Sure, but then that IC, if executing correctly should just leave and found their own startup. And true, sales/building the right thing is often #1.
It's hardly just us engineers. Plenty of startups try to radically improve things instead of just joining companies that are already doing the thing. I think this is analogous.
I never thought about it like that, thanks for the perspective.
The post explains why this works in the RCU context, why it sucks in general, and then just writes it off and ignores it.

> At this point, some folks fire back with non-arguments about how this isn’t “real” garbage collection. Like, uh, because you manually mark the garbage!

Yeah. People's concerns are that the process of figuring out what memory is not longer used is inefficient and non-deterministic relative to simply telling the allocator when you're done with a resource. I've never met someone who's been concerned with deferring deallocation.

Sure traversing the whole live set is rare and we've spent 30 years tweaking GC algorithms to make them better, and now they're practically sentient. However this statement either willfully or unintentionally writes off the thing people actually have an issue with. If you run into GC issues in your services you have to bring in a shaman to tweak things here and there hoping it sends the angry spirits back to the shadow realm.

If you're just marking the garbage and being notified when it's no longer used, that entire process is gone.

Yes, it can be very fast to allocate memory in a GC. This ignores the cost of marking and compaction that actually need to be amortized in to get a fair comparison.

The other big issue people have with GC is that in general it requires significantly more memory than manual memory management to achieve equivalent performance. And you have to have a bunch of extra CPU power to throw at redundantly checking if things are still referenced over and over. And you have to be okay with a bunch of extra memory copies for optimistic compaction.

Finally the post criticizes manual memory management (Rust's Arc/Rc) as being necessary when you have unclear lifetimes - but ignores that you basically build the exact same infrastructure in GC'd languages to close external resources as you can't rely on finalizers ever being called.

Anyways this has been beaten to death for the last 20-30 years and this article doesn't seem to bring anything new to the table besides ignoring the legitimate concerns of a GC using memes, which is fine because memes are fun IMO.

The correct answer is exactly what you say - there is no general correct answer. You use the tool appropriate to the job to meet the design constraints of the system.
> With the right sandboxing techniques, SELinux and mitigations could prevent the attacker from doing anything with root permissions.

Please review this commit[0] where the sandbox detection was “improved”.

[0] https://git.tukaani.org/?p=xz.git;a=commitdiff;h=328c52da8a2...
If you are using the Google Maps JavaScript API: https://developers.google.com/maps/api-security-best-practic...
That’s all true. But there’s still precisely zero reason to gloat after the fact.
Where is the law enforcement angle on this? This individual/organization needs to be on the top of every country's most wanted lists.
right up there with japanese shirt folding:

https://youtu.be/b5AWQ5aBjgE
I don't know about branches, but if you're just traversing history that's a textbook use for git bisect, right?
Pyka: The Future of Flight [video]
Came across this right before I start laundry, looks like I have a test to run!
GNU Mes tries to avoid this by bootstrapping everything.
https://www.youtube.com/watch?v=EFOhjljieqs

same method, but in video form.
I think we can all agree this attacker was sophisticated. But why would a government want to own tons of random Linux machines that have open sshd mappings? You have to expose sshd explicitly in most cloud environments (or on interesting networks worthy of attack.) Besides, the attacker must've known that if this is all over the internet eventually someone is going to notice.

I think the attacker had a target in mind. They were clearly focused on specific Linux distros. I'd imagine they were after a specific set of sshd bastion machine(s). Maybe they have the ability to get on the VPN that has access to the bastion(s) but the subset of users with actual bastion access is perhaps much smaller and more alert/less vulnerable to phishing.

So what's going to be the most valuable thing to hack that uses Linux sshd bastions? Something so valuable it's worth dedicating ~3 years of your life to it? My best guess is a crypto exchange.
> Curious, why not advocate for the power company to provide battery backup at the substations? Why should the only part of our infrastructure that's battery backed be the phone system?

There is a difference of several orders of magnitude between a backup power system that is able to keep a telco central office online (one singular building) and a backup power system that is able to keep an entire substation's connected subscribers online (thousands of buildings).
Been doing this for years, sans the roll/unroll. After tying the corners, reach all the way inside the inside-out cover, grab the two corners furthest from the opening, pull all the way through, and shake.
I volunteer supporting a school that has several POTS landlines still. But the infrastructure seems to be rotting. We're moving off of them as fast as we can, because they go down all the time now. That never used to be a problem back in the day. Who in the world would have thought that cell phones would ever be more reliable than landlines for emergency systems like the fire alarm?
The general sense I get from every Canadian politician, regardless of whether they're at the municipal, provincial, or federal, level, and regardless of party, is that they are much better at getting elected or re-elected than they are at actually passing legislation or making their stated platforms a reality. The federal level would be helped with an actual 3rd contender, but the NDP have been floundering since Layton passed. Instead the 2 major parties are just ideological vacuums with no point or goal but to cycle in and out of power.