skysight-inc/HackerNews huggingface dataset:
Paint.Net is by far the best non-pro graphics editor ever. So practical and intuitive. To me lack of Paint.Net seems the biggest problem of desktop Linux, also of Mac. Sadly Pinta appears buggy. But it still is tolerable and has no real alternative. Both Photoshop and GIMP feel too unintuitive and this way take too much time to do simple things when you are not a graphics pro. GIMP also arguably looks ugly. Paint.Net is a great example of the whole UX (intuitiveness, convenience and aesthetics) done right.

As I understand Paint.Net it is a WPF app. I wish the author would just use Avalonia XPF to port it to Linux and Mac. XPF is a drop-in replacement for WPF which can easily make WPF apps cross-platform for some money. I wouldn't mind paying my share.
So they can comply with Texas anti porn laws?
The discovery process for that case would be incredibly costly as it’s highly likely the AI would have been updated in between the incident and the court case.

I bet if it were a private citizen running that AI, the overzealous DAs in NY would go after them for “destroying evidence of a crime” for not preserving the state of the AI.
That scene from Sneakers takes on a whole new level of meaning - we're actually there now...
FarCry is running with highest graphics settings in a WinDOS VM on my Intel Mac, and it works astonishingly well. I still immensely enjoy playing it.
Counter intuitively, language models aren't good with letters and string manipulation. It probably has to do with tokens being a few letters and the lack of those tasks in their dataset.
I am not talking about semiconductors in particular but entrepreneurship.

Hiroshi Yamauchi moved Nintendo to playing cards to electronics on its middle forties. Going to the south and taking away age, Argentina created several unicorns: Auth0, MercadoLibre, Uala, and Satellogic. Galperin studied in USA but Eugenio Pace only studied in Argentina and worked at Microsoft, part in USA. Satellogic founders don't have undegraduate degrees.

On this argument I departed from the idea about age and/or studies and/or previous connections and/or place. It is indisputable that US is the top entrepreneurial country in the world and the one with the most opportunities but to learn the entrepreneurial subject (the top topic in YC/HN) itself you can see further.
I believe the game did autosave at "checkpoints" when certain triggers were met.
Vulkan is available via MoltenVK.

If you have sufficiently low level API that works similarly, then the benefit of two low level APIs is relatively direct translations are possible.
All great features but C# has had most of those for a very long time. Java really stagnated for awhile. Glad to see that's no longer the case.
This exact thing happened to me. I maintain a fairly popular free software project. A few years ago, I received an email from a nasa.gov domain claiming that they want to use the project internally and are auditing all their suppliers.
They wanted documentation on me and on how I audit my supply chain for the project. Not cool. I don't have time for these shenanigans in my personal time.
I would want to think it over but off the top of my head:

GitHub could provide this as a service, perhaps using uploads of whatever state/national ID the user is coming from. Give a little 'verified ID' badge. All banks do things like this for new accounts.

Granted this doesn't stop state-actors, but it should be effective against cyber criminals.

I think a system where it was harder for unknowns/newcomers to contribute but had better security is a good tradeoff. Esp. since it is likely this incident is not unique.
https://imgur.com/WGaK3Tn
Does it really matter if they have not produced a perfect clone but merely a convincing clone?
I'm baffled by all the people saying this is good writing. This is self-indulgent, showoff writing by someone who cannot maintain a consistent voice. If you liked it, give the credit to Béla Bartók, who provided the topic that held your interest, and to the Transylvanians who have conserved and preserved an ethnic culture that provides endless fascination.
Cardiac Compression Device Using Artificial Muscle for Heart Failure Treatment
I don’t think zero knowledge systems are practical at the moment. It will take over around 8 orders of magnitude more compute and memory to produce a ZKP proof of generic computation like compilation. Even 2 orders of magnitude is barely acceptable.
They don't want people creating accounts with credit cards that have very low limits. This is very reasonable and actually means that it will be cheaper for you because other (legit) clients don't have to subsidize criminals that don't pay. DigitalOcean and other IAAS need to jack up prices because of those crooks... it wouldn't be an issue if it wasn't pay-as-you-go.

Before you say that they could just verify that the credit card works by charging and then refunding it, it doesn't actually work because the crooks just change the limit afterwards.

> I know other online services do this, but usually there is a way to automatically refill credits

OpenAI does actually have this option, check https://community.openai.com/t/new-billing-model-auto-top-up.... It's available as an option when you're topping up.
As a long-time designer, this is one of my main beefs with the rise of UX Design as term for design leadership (that's compared to UX positions that include "research" in their role, for example, and are usually great contributors to a project).

When you design a digital product, it's a given that the redesign should perform better in real life situations compared to the current version. Sometimes, the current version is a digital product as well, but sometimes it's forms, a pen, and an efficient clerk. These are the benchmarks from which the product should deliver clear improvements.

Most quote-unquote UX designers of the last decade, including many authors on uxdesign.cc, have a career arc that's an ignorant rediscovery of an existing discipline (interface/product design), which they keep not learning because they must appear above the existing skills and workers to keep the illusion going in the face of their managers and LinkedIn audience.

(If you think I'm equating lots of UX designers to middle-managers who sometimes ship a wireframe, you're reading me right!)
Activity Streams is one of the fundamental building blocks of ActivityPub, the protocol that powers the fediverse (Mastodon et al.).

https://www.w3.org/TR/activitypub/
What does Devin have to do with xz?
I'll just do `git clone --depth 1 ..` in the future by default and forget about 'half-built' source releases
Do Our Oceans Feel the Tug of Mars?
I'd say there are fewer ways to hide exploits like this. Rust doesn't use configure scripts. And it has a built in testing mechanism - so there's no need for makefiles to run scripts. Any build scripts as complicated as configure in a rust project would be a much bigger red flag. And it would be rare and weird to see GNU_IFUNC in use in a rust project too.

Sure; you can hide nasty code in rust. But I think it would have been harder. Not because rust is memory safe. But because rust is decades newer, and it doesn't inherit all of the quirks in C, in its build system and obscure mechanisms for dynamic linking.
It feels like OpenAI is mostly concerned with developing proofs of the untrustability of every digital medium

Agreed. I'm still waiting for the part of AI where it's supposed to benefit mankind.

So far, it's 10% entrainment, 20% employment elimination, and 70% crypto-grade hype.

The next AI winter can't come soon enough so the tech industry can get back to doing useful things.
That 's a pretty desperate move imo haha
JDK 23: The new features in Java 23
you can always rollback.
A process can do little to defend itself from a library it's using which has full access to its same memory. There is no security boundary there. This kind of backdoor doesn't hinge on IFUNC's existence.
> It feels like OpenAI is mostly concerned with developing proofs of the untrustability of every digital medium

Which, to me, makes sense. Once the underlying technology exists, a malicious actor would not think twice before developing tools of deceptionlike those. It makes sense that OpenAI would work on that "in the open" to demonstrate that we now need to be skeptical of audios.
Porn advertising doesn't bother with contextual decline of the platform they advert on.

It's a good move by Musk, but it smells desperate.
A lot of leftist argue for worker owned businesses. Wouldn't that mean that losses would effectively be owned by the workers?
I am a big proponent of EVs, but I personally think hybrids will have a really long tail, especially as the technology improves: we could feasibly end up with a situation where much city driving in a hybrid is zero-emission EV-mode.

Two reasons:

First, in relation to your point

> Once the infrastructure is good enough

I live in the UK and I think this is gonna take a long, long time here. Not only will we need to build an enormous amount of fast chargers, but there will need to a significantly greater number of them than petrol stations, to offset the fact that even the fastest chargers take 5-10x as long as filling up with petrol (2-3 mins vs 20-30).

Of course, the ideal scenario with EVs is that most charging is done at home, with fast chargers used only on long journeys. Problem is, by some estimates 2/3 of UK households do not have off-street parking. We would need to roll out en-masse solutions for on-street charging and, to my knowledge, we have not even began to think about this outside limited trials.

Second is cost. Almost all cars have got crazy expensive over the last few years (I’m unsure if the rise of the PCP is a cause or effect of this), but over here full EVs are still not affordable for a huge number of people—myself included.

I really wanted to go electric, and was looking at the MG4; widely considered to be the best value in EVs in the UK right now. But for the model with a range that would suit us, and the cost of installing a charger, you’re looking at close to £30,000. I just don’t have that sort of money, and a finance deal would be half my mortgage again. And for context, I make nearly double the median UK salary.
Doesn't fine tuning models on GPT-4 output violate OpenAI's terms of service?
You can also just give your port number a name via /etc/services and then use that name instead - see https://man7.org/linux/man-pages/man5/services.5.html - also getent services. Then, any well-behaved program will allow you to use the service name instead of the numeric port number, and even use it for display.

This is one of those good ideas that seems to have unfortunately died / been given up on. Inside BigCo with hundreds/thousands of ports to manage, I've seen some companies do this right via ldap / getent services, and lots do it wrong via wiki pages and having humans do the numeric mapping.
Love the article. I knew nothing about this artist, but after reading this, I am curious to see his works. Gives lots of details including pictures.

The article does talk about the hazards of installing these giant steel sculptures and that workers have died and been injured.
"All things are lawful, but not all things are beneficial or advantageous"

St Pauls Letter to the Corinthians 10:23
I am not assigning any personal blame or making an accusation of bad judgement on the maintainer.

Taking contributions from anons appears to be common. I am suggesting that should change.
Facebook Intercepts Your Web Traffic [video]
Many jurisdictions actually do have higher penalties for crimes of violence committed against public officials than ordinary citizens. Assault a USPS postal worker at a post office and you automatically have a higher sentence than assaulting a UPS worker at a UPS store.
It's easy to have your existing biases validated if you already dislike systemd. The reality is that systemd is much more coherently designed than its predecessors from a 'end user interface' point of view, hence why its units are largely portable etc. which was not the case for sysvinit.

The reality is that it is not systemd specifically but our modern approach to software design where we tend to rely on too much third party code and delight in designing extremely flexible, yet ultimately extremely complex pieces of software.

I mean this is even true as far as the various CPU attack vectors have shown in recent years, that yes speculative execution is a neat and 'clever' optimization and that we rely on it for speed, but that maybe that was just too clever a path to go down and we should've stuck with simpler designs that would maybe led to slower speedups but a more solid foundation to build future CPU generations on.
Almost. I tested this a few years ago and IIRC zstd at its highest settings is typically about 5% larger than LZMA. So there is a difference, but probably not enough for most people to care.
From the article this thread is about, emphasis mine:

>It is also a sexually suggestive photo of an attractive woman, and its use by men in the computer field has garnered criticism over the decades, especially from female scientists and engineers who felt that the image (especially related to its association with the Playboy brand) objectified women and created an academic climate where they did not feel entirely welcome.
Mine does. Yours doesn't?
Well Valgrind originally went off on it and oss-fuzz presumably would have caught it since here's a PR from the attacker asking for it to be disabled: https://github.com/google/oss-fuzz/pull/10667
Discussed yesterday: https://news.ycombinator.com/item?id=39868700
The Debian message is more interesting. They try to find out what happens when all potentially suspect commits disappear. They need to downgrade a lot further - 5.3.1- and break the API. The whole situation seems nasty.
This seems like a clear cut case for RAG, supplying answers based on actual NYC code. I wonder if they're doing this and it's still failing?
How would that help? In this case the adversary is likely to be a state actor/group with a significant amount of resources available (time, money, talent, secrecy, etc.)

Consider also that in many countries the government can force a honest national to collaborate with them on introducing backdoors to any target. This can happen both in OSS and proprietary software projects btw
That's a kneejerk reaction that will likely have more negative consequences than positive ones, and it likely wouldn't even have helped in this case. Do you think that sophisticated actors, especially state level actors, aren't capable of giving fake IDs to people? Or to have a web of equally fake identities vouch for someone?

Every project potentially has security implications. A package that's used for compression today could be linked to an SSH server tomorrow. Something as banal as a todo list could be a potential attack vector in the right hands.

I don't know what the solution to this problem is. Better verification of dependencies, certainly, but how? More investment by corporate users of FOSS into security? But no matter what we do, "who's watching the watchmen" will remain a valid question.

I'm actually quite impressed that this was found as quickly as it has, though it makes me wary that there might be other, as yet unfound, such attacks.
Yes I know that one. But I don’t really see a conection still. The xz backdoor was not introduced by Debian, it was introduced by a bad faith actor via the xz project (aka liblzma). Not only Debian was affected, Fedora was too.

AFAIK there is no evidence that CVE-2008-0166 was done deliberately, whereas with the xz backdoor, there seems to be lots of signs of deliberate intent.
I’m not sure it’s fair to describe something as “dangerous” and as having “killed” people when you’re talking about technicians hired to safely move or install something.

By that definition pretty much any object is “dangerous.”
Google then YouTube
Not to mention, what constitutes a political leader? Just the upper echelon? What about local civil servants? Mayors, cops, judges?

Barack Obama started out as a "community organizer."

AI can clone someone making a public speech at that level, then store it forever until they become the president.
Old cars have two headlight settings: Low-beams and high-beams.

New cars have two headlight settings: High-beams and asshole.
I remember when Google first offered some form of encryption with Gmail - I think it was as simple as an https connection - and Yahoo refused to do so.

Google seemed like the good guy back then.

Since then things have changed on that front somewhat, and even the UI got to be unusable for basic tasks (I can't find the "next" button on the page of search results).
Brokerage, not bank, but you can do Yubikey-only at Vanguard.

https://www.bogleheads.org/forum/viewtopic.php?t=349826
National ID or verification by an employer. Both are ubiquitous and probably strong enough to at the very least prevent a significant amount of impersonations or fake accounts, which seem to play a large part in legitimizing or disguising these attacks.
How? AFAIK a passkey is just a replacement for a password. If my passkey tells you I can authenticate as john.doe@gmail.com, how does that help with establishing trust and identity?
Most software projects are not written in C. Conversely C would be used for projects where C would be less annoying than alternatives, and that condition largely precludes projects with many required dependencies. And every language-level package manager, not just that of Rust and Node, would be a disaster from the supply chain attack perspective---it can even be said that C is suffering from the huge amount of supply chain attacks in spite of the lack of good language-level package manager.
Your point is well-taken, but see my reply below. Stopping state-backed level actors might not be possible, but we can make it harder for cyber-criminals.

Has it been shown this is by a state-level actor?
Miniaturized Variable Stiffness Gripper Locally Actuated by Magnetic Fields
Yes, But it would at least be harder. C has so many weird quirks and edge cases - including decades of legacy mechanisms (like IFUNC) that almost nobody today understands.

The underhanded C contest would be a lot less entertaining in rust. Thats a good thing.

It wouldn't solve the underlying problem permanently. But I don't think there's any slam-dunk solution here. I'll take any small wins where we can get them.
Sure but then you can smuggle it into basically any other part of the build process…?
Occurrences of "jiat0218" on Taiwanese websites are clearly copypasta from some other website that's probably defunct now.

While gendered names do exist, you can't easily tell from the romanization, it depends on the exact characters used. And most likely "Jia" is the surname, or rather the romanization of one of five different surnames.
The backdoor was possible because Debian introduced a dependency into sshd, libsystemd, which in turn linked to liblzma. Official sshd does not have a systemd dependency in the same way that official sshd back in 2008 did not suffer from a predictable PRNG.

Debian is also 100% at fault here and I hope this slap in the face makes them reconsider their poor security practices. Amateur package maintainers should not be overstepping their job (packaging) and enabling disastrous vulnerabilities in security-critical software.
I was just wondering this earlier today actually, then came across this thread. Is there a vision/ML project for identifying lego bricks? I have 6-7 large tubs of Lego and we're a very active Lego family, and I would absolutely love an easier way to sort bricks than bribing the kids and getting "ok" results. :P
That’s misleading. She has been quoted multiple times saying she was amused and thought nothing of it. Until a bunch of activists came and told her she should be offended, and that the matter was of great importance to the future of mankind. Then of course she changed her mind, why not.
Indeed! Modern photographic technology (which I will admit is quite impressive) allows you to get certain kinds of shots more often, but it doesn't necessarily improve the "health" of the creative sphere of humanity. Sadly, it's the obsession with the new that sells, and I think to some extent it also harms the photographic endeavours of people because they get a bit too obsessed about gear.
Yep. You could also open in-game console and use a command to force checkpoint
Thanks. TorToiSe has been feeling a long in the tooth, and this looks a little more digestible.
They're not the only ones creating barcodes -- stamps come with non-specific data, but bulk mailers are allowed to create their own, with embedded routing and billing codes.

The spec is here: https://www.royalmail.com/sites/default/files/Royal-Mail-Mai...
Autotools are not backwards-compatible. Often only a specific version of autotools works. Only the generated configure is supposed to be portable.

It's also not the distribution model for an Autotools project. Project distributions would include a handwritten configure file that users would run: The usual `./configure && make && make install`. Since those configure scripts became more and more complex for supporting diverse combinations of compiler and OS, the idea of autotools was for maintainers to generate it. It was not meant to be executed by the user: https://en.wikipedia.org/wiki/GNU_Autotools#Usage
Almost certainly a RAG system. I played around with it yesterday - looked through the laws and found one about business requiring their scales to be certified. So I asked

I operate a meat cutting business, do I need to have my scale certified?

Answer: Yes, you need to have your scale certified. According to the City of New York's Department of Consumer and Worker Protection (DCWP), a Scale Dealer or Repairer license is required to trade, sell, receive, or repair weighing or measuring devices. To obtain this license, you must visit the DCWP Bureau of Weights and Measures Testing Station located at 245 Meserole Avenue in Brooklyn to obtain a Certificate of Approval for your testing equipment, such as a weight kit. This certification ensures that your scale meets the necessary standards for accuracy and reliability. For more information on how to apply for the Scale Dealer or Repairer license, you can visit the Scale Dealer or Repairer License page on the City of New York's website.

You can see it made the classic rag error of retrieving the wrong context and answering the question based on that. It must have found something related to being a scale repairer instead of using one in trade.
Another RMM to block for security <3
The problem is that the bank will automatically enable online access and SMS-confirmed transfers for that 100 year old person who doesn't even know how to use Internet.
What about g suite?

Google drive, docs, sheets, photo, the biz facing tools.
Those are all successful.
The connection is that sshd calls code in libsystemd when running as a systemd service, to notify systemd that it finished starting. An unrelated functionality in libsystemd (my guess is that it's related to parsing journald logs, since they can use LZMA compression) uses the lzma library, so libsystemd is linked against it. That is, the chain is: sshd is linked against libsystemd, which is linked against liblzma. When loading the sshd executable, the dynamic linker will load all these libraries.

The backdoor was added to initialization code in liblzma (which runs whenever the dynamic linker loads that library). So that malicious code runs before sshd starts executing, and manipulates the dynamic linker so that it will do something (which is still being analyzed AFAIK) when some specific functions are called by the sshd executable.
1. Our specific individual experiences are subjective, but the fact that we experience things is not.

2. It’s possible that some animals can experience some amounts of beauty, but certainly not on the level of humans. Also the lives of humans are rich and varied in ways that other animal lives just aren’t.

3. If you don’t see why preserving something as unique as humans is important… I don’t think you’re really considering how special we are.