skysight-inc/HackerNews huggingface dataset:
how does this service deal with a coordinated advertising campaign -- most likely also driven by LLM's over a period of say X months. Moderators on subs can be bought out or marginalized, while youtube reviews can also be bought out. In other words, how is an aggregated source a better and more trustworthy source of information than a single blogger who people can ascribe some amount of trustworthiness to over a period of time.
I think it could be done with a monolithic app with a single db and truly stateless external services in a single repo. I only have experience from a single shop though and that’s not how the stuff we build ends up.
X (Twitter) Is Funding Lawsuit Against Block (Square): Chloe Happe vs. Block
Awesome art!! I love it.
0*0 = 1? I've always hear it as being the output of AND
to the best of my knowledge, you are correct on all counts. the new rotary used as a generator does also have direct injection, but i don't think they gain much compression ratio from that, for the reasons you stated. it's more for efficiency. without reading up on it, i believe the combustion chamber mixture and flame front propagation is not great in a rotary (hence RX8 has 2 plugs per chamber, leading and trailing) and DI should improve on it.
Any idea when the next "Explained Visually" will get released? Really miss seeing those on HN.
I remember when there was lots of excitement leading up to Google I/O. I don’t get the sense that there isn’t as much excitement now. I wonder how long Google can continue to kill products and let search continue to worsen before they have a large reset.
This Vulture scandal reminds me of an old anecdote about car mechanic. It's a translation, so it doesn't sound as nice as original.

After getting invoice from car mechanic, a client goes over itemized list of parts and work, and in the middle sees an item called "it didn't fly - 10000". Client asks mechanic "What is this "it didn't fly" thing?". Mechanic sighs and says "Oh, well, it didn't fly. Removing.".
There is a survivorship bias problem there; what if the stupid criminals are the only ones which you notice?
> and in fact that is exactly what happened with many European plug-in hybrids sold as company cars.

The counter force to that is that lease car drivers have to meet certain fuel efficiency goals, so, adopt an efficient driving style and plug in the plug-in hybrid instead of ragging it around; I'm not sure what the consequences were though, probably more taxes. Either way, enough of a push for my colleagues with plug-in / hybrids to do the thing.
It's uncharitable and comes across as a personal attack, which is not allowed in HN comments.
The backdoor hinged on hiding things in large shell scripts, obscure C "optimizations", and sanitizer disabling. I'd expect all of those would be a much bigger red flag in the Rust world.
Sorry that happened :( What were you searching for? We'll look into it.
It doesn't really. Xwayland is pretty much an X server that draws to Wayland instead of directly to the display. You can write an X server that draws to anything: a display, a printer, a Windows or macOS surface, an OpenGL texture...

Xwayland is even based on the same Xorg codebase, it's just that the DDX ("device-dependent X") layer used is Wayland-based.
True, but no competant blackmailer would put the threat beind a paywall :)
Here's a PR on an employer-owned public Github repository where I made a change and Jared approved it. Please, let's not witch hunt.

https://github.com/getoutreach/stencil-golang/pull/404
https://en.wikipedia.org/wiki/Messaging_Layer_Security
This joke made my day.
Main ongoing thread:

Backdoor in upstream xz/liblzma leading to SSH server compromise - https://news.ycombinator.com/item?id=39865810 - March 2024 (744 comments)
Their website had just recently gotten a make over, which might be why this was posted.

https://github.com/apache/guacamole-website/pull/138

Great project
Ross was one of the most influential people in my time at Cambridge, someone of whom I was very fond and whose work I still follow over a decade later. I am deeply saddened to learn of his passing.

His dry sense of wit and humour, his uncompromising pursuit of injustice and his loathing of foolhardy decisions made by the political or moneyed elites were evident in all he did and said. Misunderstood by some, I came to respect most his tenacity; at fighting the big guy – and, more often than not, prevailing with his typical grit, logic and determination. His work continues to inspire, especially since three decades after he founded the field he would go on to be recognised for internationally, in many business and industrial circles we are still making the same basic security mistakes, driven by the same flawed economic models as Ross predicted. His work is timeless.

When he spoke, I listened, and on those rare occasions he complimented my work, I did not take that for granted. It is a regret that I did not take the opportunity to do a PhD with him. Rest in peace.
Real world GPU performance is hugely influenced by hand optimization of the CUDA kernels.
The X funding: https://twitter.com/XNews/status/1773821491626295487
There's a basic tension - why embezzle, only to not spend the money?
They'll also be announcing some new thing that is average, but as it overlaps with an existing thing that is awesome and barely related, they're of course shutting that down.
> Abdeljawad's Facebook timeline is public, so the FBI agents could have found it themselves. For the past week, she has made multiple angry posts per day about the war in Gaza, referring to Israel as "Israhell." But none of the posts on her feed call for violence

That you can see, but she may have deleted something.
I think the important difference in this case is that it can use existing optical infrastructure, "just" replacing the electronics at each end.
> Framing I've seen had it such that depending on the setting of B's detector, C would get a different result.

That was the entire point of my initial post: there's no discernible difference in the actual individual measurement results regardless of detector settings.

The quantum correlations only show up if someone compares both measurements pair by pair. And to do so, regular communication must happen.

Many sources are very sloppy when it comes to phrasing this, so you're not alone in being confused. I too thought like you way back, thinking it could be used for communication.
Automate tedious Trello workflows with GitHub Action
Move, assign and label cards based on PR info
Purely in terms of awe and wonder, OpenAI releases seem to rekindle the early 2010s spirit and excitement. And those are just silently dropped one day without even warning!
>In 1943, Prigogine and his future wife Hélène Jofé were arrested by the Germans; after multiple interventions including by the Queen Elisabeth, they were eventually released a couple of weeks later.

Those people arrested future Nobel Laureate, most valuable people we have and probably about to kill him. And now look to the East of our borders.
The CIA had plans to commit terrorist acts against American civilians to start a war against Cuba in the 60s. This is quite literally their style. For example, perhaps they were planning to blame the hack of a power plant or critical infrastructure on this exploit, then use the "evidence" that was leaked to prove it was China, and from there carry out an offensive operation against Chinese infrastructure. There are lots of subversive reasons they would want to do this.
Now hopefully we'll get a new version of mkfs that doesn't use ext2 by default when a filesystem type is not specified.
Just coat the bar in anti-climb paint.

https://en.m.wikipedia.org/wiki/Anti-climb_paint
Spotify doesn’t “do” podcast at all. I can’t just put an RSS feed into the Spotify app and subscribe to it.

Whatever Spotify is doing. It’s a horrible excuse for a podcast player even compared to Apple’s podcast app and that’s saying a lot. At least with Apple’s podcast app, I can subscribe to any podcast if I know its URL.

I use Overcast for what it’s worth - not Apple’s podcast app.
I've already spent HOURS in Midjourney generating hundreds of images just to get the perfect cyborg robot elf. I just want to use that work and upload the best of those images into the character creator, rather than hoping the prompt gets me something close to the character I want and waiting 20 minutes to find out.
It seems like they have learned floating point parameters x and y so that dequantized(bit 0) = x and dequantized(bit 1) = y. Thus there is no built in asymmetry. Or more precisely they learned a zero point and a scale but it's equivalent to this simpler model in the 1 bit case.

It still seems like there would be a problem because either [x, y] looks like [0ish, 1ish] and you can't have negative weights, or [x, y] looks like [-1ish, 1ish] and you can't have "don't care" weights. But if you have some redundancy in your neurons I guess this is acceptable because you can just cancel out the positive contribution from a neuron you don't care about with a negative contribution from a very similar neuron that you also don't care about.
Not only (standalone Xorg continues to get small features), but likely the most active.
Great points, not sure those are fixable either. It definitely has some advantages from those same things in some respects, but monetizing reddit outside of ads (i.e. ecommerce like tiktok/instagram) because of these things is going to be a challenge for sure.
> However, that design is sub-optimal for a car that you want to act like an EV. As your link shows, the Prius must have the ICE spinning at speeds greater than 42 mph. Not a problem for a hybrid, but that doesn't work for a "range-extender EV" like the Volt. Additionally, (before the current model year) Toyota's plug-in hybrids can't provide full acceleration in EV mode--they always kick in the ICE when you floor it. That's again a consequence of how the transmission is optimized for hybrid operation.

True in 2007.

But 17 years later, the Prius Prime 2024 has 100% EV mode even at highway speeds. Toyota has improved the design since that webpage was made in 2007.

Despite this change, the Prius still achieves 57 mpg, even better than ever before.

Prius Prime is a proper EV-only mode, albeit a touch underpowered but its EV mode now covers all possible driving conditions.

------

I believe the modern Prius 2024 has 17,000 RPM limits now, as well as tweaked gear ratios and far larger EV and ICE engines. Despite the larger 220hp aggregate engine, the Prius remains absurdly efficient. Both in EV mode and in ICE mode.

This is why I was saying that the Volt has wasted it's opportunity. GM was ahead in many respects 10 years ago, but Toyota has caught up. The GM advantage has been squandered.

> By making compromises to the gasoline efficiency, GM was able to create a car which acts like a real EV most of the time: A 1st gen Volt will go at least 80 mph in EV mode, and won't turn on the ICE (come hell or high water) until the battery is below 5%. And, it will do that for an honest 35 miles of freeway driving.

Prius Prime added a button to enter EV-only mode in this 5th generation design starting in 2023.

It took Toyota too long to add this feature, but now that it's here the 5th generation Prius is a far better choice.

Especially because Prius still has it's trademarked 50+ MPG and 130+MPGe ratings. Top of the line efficiency.

It's somewhat frustrating to see Toyota catch up when GM was so far ahead for so long. Also because GM killed the Volt.
Seems like an appropriately used descriptor here.
> each run has 99 stamps, then they distribute them

In that case they're not making much money per batch and they have to only ever get caught once in their life, so it's not much difference to them, it only makes a significant difference to someone that isn't mass-producing stamps.

> Dunno, we're really spending too much time attacking my bullshit hypothetical that was meant to say "make it hard for the law to have a loophole."

Well I don't think the original had any loopholes, which is why I'm pushing back on your attempt to say that by pointing out a loophole.
Warning, drunk brain talking. But a LLM driven email based "collaborator" could play a very long gMw adding basic features to a code made whilst earning trust backed by a generated online presence. My money is on a resurgance in the Web of Trust.
The demo link 404s.
I'm still early in my career in aerospace and am mulling over the same decision. What's stopping me is I'm already older and I do actually enjoy the work, whereas coding with no relation to a physical thing is not appealing. Currently thinking of trying to get into some inbetween role but haven't stumbled on something that struck me as an obvious path yet.

What convinced you to make the jump?
To be fair, if I worked for the responsible state and it wasn't China, then this is what I would do to deflect…
If you have a backdoor in a specific piece of software already, what is the purpose of trying to introduce another backdoor (and risk it getting caught)?
Nice idea, but then you just hide the attack in logo.png that gets embedded in the binary. Less useful for libraries, works plenty good for web/desktop/mobile.
A simple webapp to compute winning probability on a 3-set tennis match, from any possible score : http://tenniscalc.pythonanywhere.com/
my freaking kernels/initrd are xz or zstd compressed!
Robbing the bank with a theorem prover (2005) [pdf]
Suggested reading in honor of Ross Anderson's passing
4 years ago.

"I retired from modeling a long time ago. It's time I retired from tech, too... Let's commit to losing me."

https://vimeo.com/372265771
GenAI Detection Tools, Adversarial Techniques, Implications in Higher Education
My problem with current day planner apps
Hi folks,

Many ways to manage your day and be more productive. But here i speak on specific type of day planner apps. The one which list tasks one after another where the order matters. One popular app in this genre is “structured” app.

My problem is that they are not flexible enough to react to day changes, which ruin your plan quickly. As example you think you would spend one hour in a task, to find out it took 2 hours instead. Now i want the app to shift all tasks start times And see how this would affect the rest of my plan. Most importantly i want ways to quickly adjust the plan without making any calculations in my head. Sure, theres AI solutions like “motion” and “reclaimAI”. But they focus mainly on calendars adjustments and not a sequence of tasks that needs to be done in orderly manner.

What do you think, do i miss any apps doing the same thing ?
I believe your parent is trying to make a distinction that the handle's history may not be suspect, only recent activity, positing a rubber-hose type compromise.
> Generally in the blackhat world, attackers have very precise targets

Lol, what

> wants to cast a wide net to attack as many as possible. So that fits the profile of a government intelligence agency

That's quite backwards. Governments are far more likely to deploy a complex attack against a single target (see also: Stuxnet); other attackers (motivated primarily by money) are far more likely to cast a wide net.
Not really. xz worked fine 2 years ago. Roll back to 5.3.1 and apply a fix for the 1 security hole that was fixed since that old version. (ZDI-CAN-16587)

Slight oversimplification, see https://bugs.debian.org/1068024 discussion.
This happened very quickly during the early panny-D as well
I used a program called Monkey extensively in 1986 while performing final testing of Microsoft Works for the Macintosh to shake out the last bugs in the program. I found a quite a few bugs that would probably never occur in real life, but it made the program much more robust. Nobody ever complained about Works crashing.

https://www.folklore.org/Monkey_Lives.html
I know this is wildly off topic, but can you please share any info about your stretching routine? I have persistent IT band issues from running…
XNOR does not distribute over AND or any other binary operators (try 0 XNOR (0 AND 1)), nor does it have a multiplicative identity, so it's not really multiplication in a way that's useful.
Have you considered going outside?
clickhouse has pretty good github_events dataset on playground that folks can use to do some research - some info on the dataset https://ghe.clickhouse.tech/

Example of what this user JiaT75 did so far:

https://play.clickhouse.com/play?user=play#U0VMRUNUICogRlJPT...

pull requests mentioning xz, 5.6 without downgrade, cve being mentioned in the last 60 days:

https://play.clickhouse.com/play?user=play#U0VMRUNUIGNyZWF0Z...
Profile guided optimization is, unfortunately, wildly powerful. And it has a hard requirement that a casual link exists from test data (or production data!) to the build process.
Also in favour of balance, is the notion that growing up completely isolated from your generational peers 'normal' social behaviour can itself lead to different forms of serious long term mental trauma and dysfunction.
Accepting code from any source without properly reviewing it is surely the actual problem, no? This person only infiltrated this project because there was no proper oversight.

Maintainers need to be more stringent and vigilant of the code they ship, and core projects that many other projects depend upon should receive better support, financial and otherwise, from users, open source funds and companies alike. This is a fragile ecosystem that this person managed to exploit, and they likely weren't the only one.
Your note on affiliate marketing is what makes your first statement potentially unachievable. How does a consumer "know" that a product is significantly better to the point of "worth paying for"? There's always another free (potentially ad supported) affiliate marketer (or 5) around the corner. (Also considering the "worst" version of this
"product" is an unskippable ad").

I don't know the solution
Yes it was probably mostly FUD. But you can’t imagine the number of sales calls I sat on when I worked at AWS ProServe where I heard them talk to customers about how they couldn’t trust GCP to keep a new service around and used their history of abandoning products as evidence.
> The payload only activates if the running program has the process name /usr/bin/sshd. This means that systems that put sshd in /usr/sbin or another folder are not vulnerable. This further suspects targeting systemd systems due to their usrmerge initiative putting all binaries in /usr/bin.

This is highly likely wrong. The hack targets rpm and deb distros and as far as I know _all of them_ put sshd in /usr/sbin. The original oss-security report specifically said arg0 had to be /usr/sbin/sshd and I can reproduce his findings about increased runtime if you do so.

This /usr/bin vs /usr/sbin also has nothing do with usrmerge.

This type of mistake casts doubt in the rest of analysis.
I'm not very inclined to think this is the US govt, however, you should better acquaint yourself with the morals of some members of Congress.

I think the best reason to doubt USG involvement is the ease with which somebody discovered this issue, which is only a month or two old. I feel like NSA etc. knows not to get caught doing this so easily.
> Title text: Somewhere out there is a company that has actually figured out how to enlarge penises, and it's helpless to reach potential customers.
Is this really the lesson here? We are talking about a maintainer here, who had access to signing keys and a full access to the repository. Deb packages which were distributed are also different than the source code. Do you honestly believe that the (arguably awful) autotools syntax is the single root cause of this mess, Rust will save us from everything, and this is what we should take away from this situation?
I bought some used GPUs during the last mining thing. They all worked fine except for some oddball Dell models that the seller was obviously trying to fix a problem on (and they took them back without question, even paying return shipping).

And old mining GPUs are A-OK, generally: Despite warnings from the peanut gallery for over over a decade that mining ruins video cards, this has never really been the case. Profitable miners have always tended to treat these things very carefully, undervolt (and often, underclock) them, and pay attention to them so they could be run as cool and inexpensively as possible. Killing cards is bad for profits, so they aimed towards keeping them alive.

GPUs that were used for gaming are also OK, usually. They'll have fewer hours of hard[er] work on them, but will have more thermal cycles as gaming tends to be much more intermittent than continuous mining is.

The usual caveats apply as when buying anything else (used, "new", or whatever) from randos on teh Interwebz. (And fans eventually die, and so do thermal interfaces (pads and thermal compound), but those are all easily replaceable by anyone with a small toolkit and half a brain worth of wit.)
School of Computer Science and Statistics: Treasures Catalogue – Trinity College
There was a drama back then where serde tried to ship its derive macro as a precompiled binary: https://news.ycombinator.com/item?id=37189462
sounds like theres a healthy dose of sexism at play here.
The top comment on that clip scores home that point. While there's no way to verify that, I wouldn't be surprised if it's a lot more than we realize. That being said and to play devils advocate - if all of them are already astroturfed with some people discovering that, then how much do most people care about it?
Passkeys are being introduced right now in browsers and popular sites like a MFA option, but I think the intention is that they will grow and become the main factor in the future.
I tried to understand the significance of this (parent maybe implied that they reused a completely fictitious identity generated by some test code), and I think this is benign.

That project just includes some metadata about a bunch of sample projects, and it links directly to a mirror of the xz project itself:

https://github.com/se-sic/VaRA-Tool-Suite/blob/982bf9b9cbf64...

I assume it downloads the project, examines the git history, and the test then ensures that the correct author name and email addresses are recognized.

(that said, I haven't checked the rest of the project, so I don't know if the code from xz is then subsequently built, and or if this other project could use that in an unsafe manner)
pRoBaBlY a StaTe AcToR

zero definition of what that means...

egos of people who just like to say cool words they don't understand

lol

this comment will probably get deleted, but let the action of this comment being deleted stand that in 2024 we're all allowed to use big words with no definition of what they mean -> bad

state actor? who? what motive? what country? all comments involving "state actor" are very broad and strange... i would like people to stop using words that have no meaning, as it really takes away from the overall conversation of what is going on.

i mean you're seriously going to say "state actor playing the long game" to what end? the issue was resolved in 2 hours... this is stupid
I still believe it's possible - for example by having all the blades enclosed in a ring you can avoid gas escaping 'round' the blade.

And with metal 3d printers rapidly falling in price, I think it will get within the scope of university students to prototype soonish.
They're hiring a unique person per batch, who gets paid tens of dollars at most, and none of them are willing to say who hired them?
I was thinking more cheetahs and leopards to humans.
Hmm, well they never find these kinds of attacks in closed source code. OTOH they never find these kinds of attacks in closed source code!
Doubt the target is archiving software itself - presumably the reason these libraries got picked is because they already have high penetration across many layers of the stack which would ensure the backdoor has wide coverage.