skysight-inc/HackerNews huggingface dataset:
It wasn't hard to setup headscale (or netbird for that matter). I have setup both to test at home fairly easily. They aren't appropriate for a corporate setting though. I actually want to pay somebody for this because I want the support when some change causes this to eat it at 4 in the morning with the business day about to start with a strong requirement for it to be working.
ClamAV also has a lot of findings when scanning some open source project's source code. For example, LLVM project's test data. Because some of the test data are meant to check if a known security bug is fixed, from a antivirus software perspective these data files can be seen as exploits. ClamAV is commonly used. Or, I would suggest adding it to every CI build pipeline. Most time it wouldn't have any finding, but it is better than nothing. I would like to offer free help if an open source project has the need to harden their build pipelines and their release process.
Ability to do it realtime in video games in general seems huge.
One big difference between life in 1719 and today is the pervasive feeling that humanity is somehow bad or immoral and that the sustainability of the lives that we live are precarious. The combination of the internet, advances in science and our understanding of the world, the complete inundation of all media with news, and the fact that bad news is easier to engage with, has created this curtain of gloom across the educated spheres of the human race.

I personally believe this phenomenon is the cause of a great many of the current problems we have today. Excessive greed and hoarding is a fear response. Rabid political polarization either to try to fix the problems we face or ignore them and protect our mental health. There is a large shortage of faith in the future, and there's a lot of realization that technological advancements of the past have created some of the overwhelming problems we face today.

Distraction and nostalgia are the best selling items in the modern world. Depression and suicide are the highest they've ever been. The social fabric is unwinding, and communities are dying, and an article like this comes along that makes me wonder just how it would feel to struggle and strive in a world in which the future had so much potential.

Who knows though? Maybe this feeling is something that was pervasive in these times.
> If you don't know your own country's history why are you speculating on the history of the USSR?

What does my country history have to do with anything on this discussion? It's all about the US and the USSR.
this is why microsoft bought github and has been onboarding major open source projects. they will be the trusted 3rd party (whether we like it our not is a different story)
You were trying to argue that your ancestor was employing a false equivalence, that the disinformation campaign on both sides were in fact not equally bad.

I agree that there is a false equivalence, however I disagree with you that it is Hamas which is extraordinarily bad while Israel is relatively not as bad. The actions Israel employs against free press during this genocide are telling, and have consequences. There may be free press within Israel, however that free press does not have access to Gaza because the Israeli military does not grant them access. The targeting of journalists the Israeli military is guilty of also has consequences for the supposedly free Israeli press. If you are working in Gaza and you are afraid Hamas member will push you off rooftops if you publish a critical piece, well... if you are an Israeli journalist, you should indeed be very afraid if you are going to cover a story about Israel’s crime in Gaza. More then a few journalists have indeed be targeted and killed by the Israeli military for trying to do that, including international journalists.

What you should take from this is that it is the Israeli military that has the greater potential to lie about their crimes here, and there is no free press in this world (especially not in Israel) which can safely cover those lies.
That's not true all the components and CADs are accessible. Ok a folding display might be an issue but the rest is straightforward enough
LZMAO
>because the employers don’t want to be responsible for their healthcare.

An argument for some kind of baseline, nationalized health insurance. Removes that burden from Employers and they can then turn to the far cheaper option of employing them for an extra 10 - 20 hours a week + raises.

Employers can use insurance benefits as hiring incentives, further creating better competition in the market for employees.
Turning a Raspberry Pi Pico into a GPU with DVI Output
>> mature forest is generally close to carbon neutral.

> Even the 19th century portions are filled with all manner of life / transpiration.

Definitely. We own and live on a somewhat similar parcel in Vermont next to the Green Mountain National Forest. I'm actually not saying that you should cut these areas, only that that you should consider doing so if your primary goal truly is carbon offsets. Although I think offsetting carbon is a good thing if all else was equal, it's not the thing I would prioritize here. You are a drop in the bucket next to all the adjoining land. Think of what you can do differently to provide for niches that are not already provided. My personal emphasis is focused more on wildlife habitat than carbon.
MIT licence really suitable?

https://discourse.redox-os.org/t/mit-licence-really-suitable...
On that last point, I wouldn't pass around the certificate to log in from multiple sources, rather each source would have its own certificate. That is easy & cheap to do (especially with ed25519 certs).
If the market was mainly national and now it's increasingly global, why wouldn't it?
AI doesn't suck any more than a socket wrench sucks in the hand of a bad mechanic. But ask a world class mechanic if they'd ever give up their socket wrench. Some businesses just aren't competent at taking advantage of new things, and competition is fierce. Just like the dot-com era, everyone wants a piece of this new pie, even less competent folks, and most will fail, but many will get rich. Plenty of businesses are already making gobs of income, with just some public model off civitai and a well crafted prompt, wrappered into a slick subscription website. Personally I find AI a godsend and have duct taped dozens of HTTP POST API calls with huge custom prompts to anthropic/openai/groq/etc all over my mac hotkeys and phone voice assistants (via Tasker tasks) etc. Anything that an LLM can do to make my life a little easier, I turn it into a HTTP request and tie it in to some automation.
I’m confused. I make a unique private key for each machine I use. How is using that machine-specific key on multiple hosts insecure?
From the article, it seems like the distortions were introduced by policy makers. There was a tax benefit from building new homes in certain places. In those places, prices went down. However, the policy allowed the tax benefits to be claimed against any homes the developer built. This meant a developer could build in tax advantaged locations even though there was already over-supply there. This did not help locations where there were no such benefits so prices continued to rise there. This creates a situation where supply increases (in tax advantaged locations) and price increases (everywhere else). This is a policy failure not a market failure.
They’ll probably raise prices or absorb the costs, but it’s not a big enough cost to move the needle on inflation. These people make peanuts, and will even after the raise.
> Productivity dips on Fridays — especially in the afternoon — whether workers are in offices or at home, researchers at Texas A&M found

The study in question is from the 2017-2018 period which kind of breaks the premise of the whole article.

Also from the same study, to nobody's surprise:

> The study’s findings suggest that fatigue and stress can accumulate throughout the workweek, potentially leading to decreased productivity, particularly on Fridays
> Check out Getaround or Turo.

Both seem to be very US-focused, and CA specifically.

> In major cities there's zero paperwork,

For a very narrow definition of major, perhaps.

> They're very cheap and you can rent by the hour. There's a getaround parked in the white zone in front of my apartment building that's $53 per day.

For a very broad definition of cheap, perhaps.

And is it going to be available when you actually need it? Even the most congested highways are practically empty a pretty large portion of the day, but that doesn't help you for shit during rush hour.

> and the car is parked in a parking lot a short walk from where you already are.

I assume "huge parking lots everywhere with lots of space" is another US-ism.
Sure, leave it alone long enough and you'll get something.

But I doubt even after 1,000 years you'll get anything close to the complexity or richness of whatever original ecosystem was there in the first place.
Poor immigrants now == booming growth over the medium term. Rich immigrants just spend the locals out of their homes. The west is importing the wrong type of migrants.
Gary Stevenson [0] is the only economist who makes sense to me on this issue. He mostly speaks about the UK but we're basically all in similar boats with house prices across the English speaking world.

Gary put his money where his mouth is, and was the world's most successful trader for three years running. However, since he talks in a candid and coherent manner about inequality and the stunts the ultra-wealthy pull, you'll never see him get to talk for very long on any mainstream news source.

That hasn't stopped his new book from being successful though, due to the popularity of his YouTube channel.

0 - https://www.youtube.com/watch?v=GcaiTZKlCj4
They are a bit pricey, but if you are looking for hops flavor but no alcohol Hoplark had me gobsmacked: https://hoplark.com/collections/hoplark-water/products/hopla...

Great hops flavor and it's literally water.
We understand it completely. However, since determining the private key that corresponds to the public key embedded in the backdoor is practically infeasible, we can't actually exercise it. Someone could modify the code with a known ed448 private key and exercise it, but the point of having the PoC is to scan the internet and find vulnerable servers.
Do you think slacking off a little has changed with the massive shift to work from home?
> Dean Nordman never sought treatment for his drinking, but after his emergency surgery, his sons moved him into a nursing home, where antidepressants and a lack of access to alcohol improved his mood and his sociability. He died in the facility’s memory care unit in 2017.

Is it just me or does drinking oneself to death at 77 not sound that bad when its compared to spending 6 years in a facility (for god knows how much money)
Thanks, I was also a chain smoker and for me quitting smoking is much more difficult. You get to experience hallucinations, depressions and severe withdrawals. Alcohol is just more about losing your social activities, and being weird around your drinking buddies, but eventually time will make them understand.
Also measuring productivity is difficult in many cases. I can sometimes be more productive just thinking in the shower in the morning than I am copying text from one place to another.
The argument is that the immigration rate has nearly doubled compared to the baseline (https://www.statista.com/statistics/443063/number-of-immigra...) and that the country isn’t set up to absorb such a higher number of immigrants, not that immigration is bad as such
In general, my gut feeling is that I expect the majority ClamAV installations to be configured to scan for Windows viruses in user submitted content. Email, hosting sites, etc.
No, businesses are discovering that the uses that it is being sold to them for are inappropriate.

It may not be factually accurate. It may say disturbing things. It is not a reliable company representative. This does not mean AI sucks, it means you are trying to use it for things it is not appropriate for.

On the other hand, it can be a massive time saver for staff who know what they're doing and can interpret it's output. It's a tool that can boost output, not a replacement for people.
Maybe we should consider moving more and more system process to webassembly. wasmtime has a nice sandbox. Surely it will decrease the performance, but performance is not always that important. For example, on my dev machine even if SSHD or apache's performance dropped 3x because of that, I wouldn't mind. If I really care, spend more money to get a more powerful CPU.
Presumably the state actors are looking for other state actor's bugs, and would try to fix them, or least fix them to only work for them.

That's quite a game of cat and mouse.
The graph shows a significant shift in behavior (not just on Fridays) in Q1 2023, i.e. when many many companies initiated mass layoffs. I'm not surprised, as this lines up with my own observations in personal life. After that, many remaining employees reevaluated their relationships with their employers and with work in general.
I enjoy brewing some loose leaf* green tea with varying ratios (leaf, water, temperature, time). Others might enjoy it! I think it's a fantastic replacement beverage that helped me cut soda.

I like doing 4g of Japanese sencha leaves, 80-100mL of water, at 60-70C for 30s to a minute. Second steep 10 seconds, and third 30-40 seconds. But honestly the fun is in experimenting! (plus at lower temperatures you can drink it right away!)
Replace alcohol with opiates?

You have quite the risk tolerance.
Awesome, now enjoy the alcohol free journey.
Reference counting is neither lower latency nor lower memory overhead than basically everything else.

Reference counting requires atomics on every single object. Per object atomics are quite unfriendly to modern microprocessors.

There is either very little contention with lots of atomics that you don't need or you have high contention with atomics that are blowing out your cache lines repeatedly.

In addition, managing reference counts practically requires RAII semantics and all of the baggage that goes along with that. Doing reference counting in C, for example, is extremely error prone.
No, that's not what I was trying to argue; in fact, I said the opposite thing. At no point have I tried to argue that Israeli journalism is more trustworthy than Gazan journalism, which is not something I believe.
This implies that testing is "more stable" than sid, which is often not the case, if what you care about is breaking changes. Broken packages in sid tend to be updated fairly quickly, whereas breakage in testing often stays broken for quite some time until the fix is promoted.
Maybe we'll see a return to building sized computers like the vacuum tube monoliths of yore
Ah, so the next stage would have been to add a "bug" in xz that would trigger during the supposedly sandboxed execution, when presented with certain input files. Clever.
I would like an open source feature phone. Something like The Rotary Un-Smartphone (https://skysedge.com/telecom/RUSP/index.html). Just a plane phone.

I have never had a connected smartphone and I do not think I am missing much in my life. I carry an old smartphone without a SIM. I can take pictures and browse the web with wifi. I would like to find some sort of "life recording" software. When I find a good Linux tablet I will use that.
That's funny, you'd think they'd have figured out historically that this probably isn't going to work very well. It's easy to place a sin tax on tobacco because it's a pain in the ass for people to grow and process it themselves at home.

But it's significantly harder to raise taxes high enough to discourage people from using a product if they can just make it at home in a five gallon jug with water, sugar, and baking yeast.
Probably not.

It will likely result in a cut in hours for marginal workers, boosted hours for higher productivity workers and more outsourcing/automation.

Labor intensive restaurant operations will have a competitive disadvantage to capital intensive models, and so we’ll see more capital intensive ones thrive.
Not everything is detectable at runtime, such as syscall numbers (which is what's being tested for here).
Two sides of the same coin, IMHO
It's what people don't get about the excesses of capitalism/free markets. They serve a function. We get massive productivity/research/business process gains of millions of people putting their money where their mouth is everyday and playing a repeated game for more money/size/ influence from providing a better solution. That only works if people are reasonably sure they will keep the gains from their risks/hard work so we can't just steal the proceeds from them before it gives outsized clout to their more than likely idiotic descendants. Instead we need it to be reasonably easy for them to lose their money in a way that doesn't deter future risk taking of everyone else, of which this is one way.

I actually think this function is the real reason it's so bad that Rehnquist kneecapped antitrust so badly in the 70's through 90's and we have a nation of oligopolies now. The oligopolies can exercise outsized market power and stay in existence for way longer than they would otherwise, which gives outsized and long lived returns to the idiotic offspring at the expense of pricing above marginal cost for society, which does harm us on every purchase via the higher price, but really harms us through keeping idiots in excess wealth that should have gone to some smart upstart, costing us decades of that upstart making wise choices.
It's not by design, unlike what siblings say. It's by accident (so, "legacy", as you put it).

The problem is that already in the 80s there was tons of variability from on Unix system (or version of it) to the next, but there was no standard way of representing what features/standards/APIs/libraries a system supported or had installed. When faced with such a mess people wrote code to detect features are present on the target host.

This then got made into tools with libraries of detection code. Think autoconf/autotools.

Now we also have pkgconfig, but it's too late and it was not enough anyways.

Some things you might only detect at run-time, provided that their ABIs are stable enough that you can copy their headers into your application.
Absolutely, instead of pretend-work and twiddling thumbs people simply log off at the end of their shift, or take breaks when necessary. It seems much healthier to me vs traditional power plays over working hours that result in no benefit for anyone.
I work for a large closed-source software company and I can tell you with 100% that it is full of domestic and foreign agents. Being open source means that more eyes can and will look at something. That only increases the chance of malicious actions being found out ... just like this supply-chain attack.
Rents fell during the pandemic in Australia.
Source link without the infosec.exchange redirect: https://chaos.social/@singe/112185570592849973
My s3-ocr tool could do that with quite a bit of extra configuration.

https://github.com/simonw/s3-ocr

You would need to upload them all to S3 first though, which is a bit of a pain just to run OCR (that's Textract's fault).

You could try stitching together a bunch of scripts to run the CLI version of Tesseract locally.
I'd also recommend Hoptea.
Yeah, but I’m wondering where the code review was done. In a different context, would this be easier to spot?
Wouldn't surprise me if the "encoding" was just unencrypted UUIDs.
Rents came down significantly during 2020 in San Francisco (I paid ~2500 $/mo in Nov 2020 for a place that rented for 3300 $/mo the year before)
That's an easy thing to say after the fact indeed but yes. In fact after such a disastrous backdoor I wouldn't be surprised if OpenSSH moved all code calling external libraries to unprivileged processes to make sure such an attack can never have such a dramatic effect (an auth bypass would still likely be possible, but that's still way better than a root RCE…).

At this point “All libraries could be malicious” is a threat model that must be considered for something as security critical as OpenSSH.
New England Study Calls for Dramatic Increase in Sustainable Forestry
Full PDF report: https://wildlandsandwoodlands.org/wp-content/uploads/2024/03...
I don't love unified diffs as a rule either. They're very noisy to read in general.

A side by side in something like "meld" will highlight changes but also means you're reading the full context as it will exist in the code base.

My number one complaint about "code review" is the number of people who simply run their eyes over the diff (in private orgs) because management says "code review" and that's as far as they ever take that in terms of defining outcomes.
Jia-had
Currently if you visit the xz repository it is disabled for violating github's TOS.

While it should clearly be disabled, I feel like github should leave the code and history up, while displaying a banner (and disabled any features that could be exploited), so that researchers and others can learn about the exploit.

In more minor situations when a library is hosting malicious code, if I found the repo to be down I might not think anything of it.
Ask HN: Immigration attorney for EB1A or O1 for early startup engineers?
Can anyone recommend an immigration attorney for an EB1A green card for an early engineer at our startup. We don't have anyone in our network who has done it so recommendations would be really appreciated!

The engineer has several patents + commercialization, some publications + citations, and played a leadership role in the startup.

If anyone here has gone through the process and recommends your attorney, I'd love to hear about that too!
Depending on what you're after, Brother inkjet printers probably check some of the boxes.

Ink is open

Drivers are pretty open and full featured

Printers often have quite a bit of open features for accessing directly.

I used to think print heads were pretty common and learned otherwise when looking at apps like Qimage Pro to get different usage out of it
> install beehives

Commercial beehives, or even hobbyist level bee-keeping, displace native insect populations. They're very aggressive insects. Pollen and nectar seem like limitless resources; they aren't. Swarms can take over bird-nesting hollows, and drive out native mammals.

I have hives. Yeah, I don't feel great about it, but there are compromises baked into everything.
I know from your other comments that you are knowledgeable in these areas, so perhaps you could explain further? I could be wrong, or as I think might be the case, the situation might be different in different ecosystems. The Northeastern US has more forest cover today than it's had since immediately after it was settled by Europeans 300-plus years ago. We should stringently preserve the tiny remnants of old growth that remain, but we've got a lot of 50-150 year old regrowth to work with. While preserving it from development should be a goal, it's not clear that leaving it untouched is the best strategy.

To focus the discussion, here's a very recent report by the group I linked above: https://wildlandsandwoodlands.org/news-and-stories/new-engla....

I just submitted it here: https://news.ycombinator.com/item?id=39880257. I'd be interested to read your criticism of it.
I suspect it's because inkjet/laser printers are actually very complicated devices and it's not that easy to create viable alternatives - especially when the Western companies are already selling their printers at or below cost.
I believe Sun Tzu demonstrated it with 180 concubines.

He first explains the process. Takes the blame on himself if the instructions were not clear. When the failure continues, he warns. And if it continues again, he punishes.

https://titusng.com/2013/03/04/the-test-of-sun-tzus-art-of-w...
would 5 eyes, 9 eyes and even 14 eyes be enough?