skysight-inc/HackerNews huggingface dataset:
Please don't?

1. You don't actually know what has been done by whom or why. You don't know if the author intended all of this, or if their account was compromised. You don't know if someone is pretending to be someone else. You don't know if this person was being blackmailed, forced against their will, etc. You don't really know much of anything, except a backdoor was introduced by somebody.

2. Assuming the author did do something maliciously, relying on personal reputation is bad security practice. The majority of successful security attacks come from insiders. You have to trust insiders, because someone has to get work done, and you don't know who's an insider attacker until they are found out. It's therefore a best security practice to limit access, provide audit logs, sign artifacts, etc, so you can trace back where an incursion happened, identify poisoned artifacts, remove them, etc. Just saying "let's ostracize Phil and hope this never happens again" doesn't work.

3. A lot of today's famous and important security researchers were, at one time or another, absolute dirtbags who did bad things. Human beings are fallible. But human beings can also grow and change. Nobody wants to listen to reason or compassion when their blood is up, so nobody wants to hear this right now. But that's why it needs to be said now. If someone is found guilty beyond a reasonable doubt (that's really the important part...), then name and shame, sure, shame can work wonders. But at some point people need to be given another chance.
Aha a dunce cap.
I like how the primary rebuttal is my use of a non-standard academic term on a public forum non academics read. Hear that unzipping sound? That’s reality itself coming apart because the Jedi Sacred texts were not recited from just so.

Really just proving my point that academia is obsessed with little more than normalizing symbolic logic. Such conservatism and thought policing is en vogue across social contexts these days.

I earned a BSc in EE and bailed on an MSc in elastic structures as such notions about academia seemed pretty obvious to me all the way back in the 90s. It’s all mathematical generalization of how matter coalesces at speeds relative to light, arguing for such specific recitation of truth is the problem: you aren’t owed that. The “human” language aspect is arbitrary to me, but often seems to convince the public some BS is immutable physics only for the BS to be falsified decades later.

Scientists do a whole lot of saying what they promotes them, damn the externalities. Has more in common with our economics in that way; can human scientists coupled to human nature to keep their meat suit alive escape such a bias?

I’m not anti-science, I’m anti-contemporary institutions. Only 14% in the US hold more than a bachelors, yet their influence is wide and deep, and (charitably) forever incomplete. A minority have outsized influence over everyone yet their so-called discovery is often restatement of a well known phenomenon or just wrong, damn the externalities.

Resolving all scientific inquiry (I’m sure someone will take offense such specific an idea can exist; academics like to flip flop between arguing for generalization and specificity like typical humans) would mean knowing all states of all matter and energy. Physically impossible, there will always be “holes”. Outwardly academia is dishonest in that regard, and the incompleteness of their work. IMO out of fear society would turn against them. Probably rightly so.

Science is important. I’m not anti-science. I’m anti-institutions manipulating the actually innumerate into serfs based upon (charitably) incomplete and more often than not, outright wrong conclusions.

Academics want to go on about non-experts being wrong and their egos. Well academics are humans mired in the same human condition. Turn the mirror around.
Yes, I completely agree with you. If the total of interest + other costs is higher than rent, then yes it is a better deal to rent. But you can not include equity paid when comparing to the cost of renting.
My point exactly.

In a chart of world gross domestic product for the last 12 months, when was it at zero?

In a chart of ocean salinity, when was it at absolute zero?

Is it inherently deceptive to use a y-axis that doesn't begin at zero?
I disagree with the authors assertion that a simple watermark would solve the issue. I don't see how you can ever enforce something like a "Clean Air act" against AI. AI is a spectrum and thus it will be a gray area.

It would require a draconian system in place that would make people swear that content their posting isn't AI and then have steep penalties for breaking "the oath". But what if someone used a spell checker? Grammar checker? or sentence rewriting in Grammarly? should they be punished for breaking the "clean internet act"?

If an honor system doesn't work, then one possibility is to use an economic system so that there is a cost and value associated with the content being produced. However as we have seen with the decline of journalism, is that is hard to get people to pay for quality content. so the cheaper content would still win.

Maybe something like a legal tax for content produced could work though. If you produce over Xmb of content as an individual you start to get taxed on your "pollution" to the internet. Single internet user just posting: no tax, influencer posting youtube videos: small tax, AI company dumping out 1000s of books and 1000s of videos: big tax.
deb packages are xz compressed...
4.5Ms faster speed than broadband
Yeah but by the time you're able to afford one you will be married with kids and therefore prioritize practicality over drifting.
> You don't have the natural right to professional-level voice acting for free

I also don't have the natural right to work as a professional-level voice actor.

"Natural rights" aren't really a thing, the phrase is a thought-terminating cliché we use for the rhetorical purpose of saying something is good or bad without having to justify it further.

> The tech is simply something that may be possible, and it has tradeoffs, and claiming that it's an accessibility problem does not grant you permission to ignore the tradeoffs.

A few times as a kid, I heard the meme that the American constitution allows everything then tells you what's banned, the French one bans everything then tells you what's allowed, and the Soviet one tells you nothing and arrests you anyway.

It's not a very accurate meme, but still, "permission" is the wrong lens: it's allowed until it's illegal. You want it to be illegal to replace voice actors with synthetic voices, you need to campaign to make it so as this isn't the default. (Unlike with using novel tech for novel types of fraud, where fraud is already illegal and new tech doesn't change that).
The latest one is also just more lambdas. Like that’s impressive but DWDM itself took a decade+ after gear was introduced.

Most of the time it’s easier to just add another few dozen fibers when laying cables.
I would have loved to know what I know now when my father had leucemia.
He did everything the doctors told him to, but died a very ugly, painful death. I fucking hold his hand when he died so FU.

He was eating and acting wrongly and was in the wrong state of mind - last one I knew and tried multiple times to get out of it, but he did not listen.
Are you sure it's the bears that are invading or is it the monkeys with their stick technology?
I would be very pissed if they did this to me. Luckily it's illegal where I live.
And what law would you use to target someone who wrote some code and posted it for free on the internet that was willingly consumed?
I am mildly annoyed that Toyota calls late intake valve closing (LIVC) an "Atkinson-cycle" Atkinson made 3 engines none of which are anything like a 4-stroke with LIVC. The closest is perhaps his two-stroke engine, which kept the exhaust valve closed during the power stroke and open for part of the compression stroke.

The Miller-cycle is much closer to what the Prius uses than anything Atkinson made; it was a traditional 4-stroke with LIVC, but required a super-charger to generate power at low RPMs.

The Prius has a CVT and electric motor, overcoming any issues at low RPMs. Also now that VVT is more common, many engines run with LIVC under certain conditions.
It's wild that this could have laid dormant for far longer if the exploit was better written-- if it didn't spike slow down logins or disturb valgrind.
One problem is that many problems seem easier than they are, and you only find out that they're hard by failing to solve them. I have often wondered how many unremarkable foundational results would be considered major accomplishments if they didn't have the mis(?)fortune of being found by the first person who tried.
Just gutted. :(
Why have humans evolved to have a long journey to adulthood? Essays
The headline is misleading, and the article isn't much better.

It doesn't say what the project was, or what Poyzer's role in it was supposed to be. It's not a production of "Mamma Mia"; it's just identifying her as somebody who is known for being in that show.

I know a lot of actors, writers, and other artists who are afraid of being replaced by AI, and with good reason. The new SAG/WGA contracts will at best delay it.

But I don't think it's anywhere near ready to replace featured roles, even for voice acting. It's hard to imagine that she just lost a starring role to AI. If that's what happened, it is indeed an extremely big deal. I know that's coming, but I don't think it's today, and the vagueness in the article implies that it's something else.
How I'm personally seeing it, the sole reason for burnout is doing stuff you're not enjoying, for too long. Then, the solution I'm trying to follow is to organize my life in such a way that I never feel the pressure of deadlines, as well as any need to communicate with people I dislike.
I haven’t seen this suggested before! It seems like a very obvious factor in ageism.
I am also confused about what this paper is describing. My read is that having two staff (a dedicated barista and a dedicated cashier) outperforms having one staff (working as both barista and cashier). This seems like a trivial result, am I missing something?
Digital controls, too error prone. What you want is this bad boy on low: https://i.ebayimg.com/images/g/segAAOSwlj5g~oQ6/s-l1200.jpg
Only recent in relation to the classics, but I really enjoyed the following (the years are approximate). There are others, but I've listed these ones specifically because those others have already been recommended elsewhere in the thread whereas these may get missed.

- Adam Roberts: New Model Army (2010?)

- Hiroshi Sakurazaka: All You Need is Kill (2005?)

- Mike Resnick: The Dark Lady (2015?)

- KC Alexander: Necrotech (2015?)

- Gary Gibson: Stealing Light, Nova War, and Empire of Light (2013?)

- Linda Nagata: The Last Good Man (2015?)
> That means you either have to compile software locally on each machine, or you have a combinatorial explosion of possible features.

Or you just have to buy a lot of the exact same hardware. Secure installations tend to do that.
I don't see how showing the binary diffs would help. 99.99999% of people would just scroll right past them anyways.
I haven’t seen any TTS take 15 second audio samples and capture the speech so well.

It’s getting clearer — in the future, if you didn’t see it happen in real life then it didn’t happen.
I understand the difference, but if you find yourself inadvertently getting between a black bear and her cubs, I think you'll find they can be very dangerous, also.
What looks legit about a gmail address and some stock art for a profile?
How to saw off the branch you are sitting on..

> Amazon, Google, MS, and all the rest easily have the talent and resources to create a Redis replacement with code that already exists.

And they most possibly will. Goodbye, and thank you for the fish!
There are, and they need to be fixed.
I got to try this in private beta and it's really cool!
I use Jekyll just for the footer and nav/header. No blog and no cms. Not using sass or markdown. I installed it once, made everything local and turned it into a zip that a bash script unpacks into a name.local folder. Simple enough for me. Gem file just calls Jekyll current version and done.
Obligatory Ollama link: https://ollama.com/

May be of interest.

Check out Ollama's Modelfile, too: https://github.com/ollama/ollama/blob/main/docs/modelfile.md
Elon Musk's updated Grok AI claims to be better at coding and math
Ross Anderson embodied a lot of positive principles in the security community. His book on Security Engineering (2nd edition is the biggest book on my bookshelf) patiently laid out principles of good security design, and tied it to examples in the real world for designs and bugs. Releasing old editions for free was the cherry on top for making his knowledge available to others.
> much more than in other European countries, with something like 60% of all European brown bears.

There are about 5000 (even it it were 10,000) in Romania, which is way less than 50% of the european population.
https://www.euronatur.org/en/what-we-do/bear-wolf-lynx/bears...
There is zero web presence for this person and associated email address.

Looks more likely a fake identity than compromised account.
I worked for him at a 7 person consulting company in the 90's before his work on PostgreSQL. Back then he was a very focused and driven individual. We didn't stay in touch, but I bumped into him a few times at conferences and it was always good to catch up. RIP Simon and much love to friends and family at this difficult time.
.. well, you can use a shim package as devuan did.
The bar is low there. Also many are fake. None of them can survive even against Chinese startups (look at the mobile phone market for example), forget American.
People still complain that machine translated Japanese is garbage so I bet will be the same with programming, some easy tass will be automated, complex stuff will be still done by humans with experience and understanding of the domain.
> From the article: "Initially starting sshd outside of systemd did not show the slowdown, despite the backdoor briefly getting invoked." If I understand correctly the whole section, the behavior of OpenSSH may have differed when launched from systemd, but the backdoor was there in both cases.

It looks like the backdoor "deactivates" itself when it detects being started interactively, as a security researcher might. I was eventually able to circumvent that, but unless you do so, it'll not be active when started interactively.

However, the backdoor would also be active if you started it with an shell script (as the traditional sys-v rc scripts did) outside the context of an interactive shell, as TERM wouldn't be set either in that context.

> Maybe some distributions that don't use systemd strip the libxz code from the upstream OpenSSH release, but I wouldn't bet on it if a fix is available.

There's no xz code in openssh.
TIL NonStop lives.

https://en.wikipedia.org/wiki/NonStop_(server_computers)

https://www.hpe.com/us/en/compute/nonstop-servers.html
you seem very sure of your declarations here; im not sure you've looked too far beyond your bubble. i have worked within a rational meritocarcy for the past 15 years.
JiaT75 also has commits in wasmtime according to https://hachyderm.io/@joeyh/112180082372196735
I mean, sure, in the scope of the universe then there's plenty of time before the heat death for some humans to explore another star system, they just won't really be able to communicate about it and relay back to us within a human lifetime really.

I'm just kind of hoping that physicists are all wrong, and that there turns out to be some fancy math that allows to do something faster than light. Not saying it's gonna happen that way, but a guy can dream.
> perpetual

> without compensation

Truly exquisite contract drafting, gentlemen.
Another source here: https://twitter.com/duncan_2qq/status/1773752269395099774

Incredibly sad news, a great loss.
Sub 1-bit has been done at least as far back as 2016 for VGG style networks (my work).

I was able to get 0.68 "effective" bits.

The idea is that in each forward pass you add noise to each weight independently drawn from normal distribution, and when you calculate snr, it's sub 1 bit. Points to the idea that a stochastic memory element can be used.

https://arxiv.org/abs/1606.01981
Once somebody actually does this people are gonna complain the same as always: "The sole purpose of your project is to rewrite perfectly fine stuff in Rust for the sake of it" or something along these lines.
Transmission speed limit of quantum entanglement:

https://news.ycombinator.com/item?id=39865641
Also I saw this hans jansen user pushing for merging the 5.6.1 update in debian:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1067708
Min read for artists planning to tour independently
This is only surprising because it’s the US. I mean if the US security apparatus says “national security” all of the allies are supposed to drop everything and send them on the first military plane back across the Atlantic.
SQLite is a replacement for structured data stored in a file. If your data store is a big XML or JSON or CSV, SQLite may be a better solution. For example, I’m using it for ETL tasks and it’s working well for this use case.

If you need a networked database supporting many users, probably better off with Postgres.
lol classic HN down vote without comment...
I would have sworn I read it in the linked article, but it's sure not there when I read it again. And it's not in the oldest archive.org copy either. I can only conclude I hallucinated it, which makes me uncomfortable.
Pretty sure ascorbic acid is the most common antioxidant preservative (sometimes naturally occurring of course). But it is not an antimicrobial agent, hence the frequent problematic combination with benzoates. Tho, not sure about the US, I think benzoates are not the most common antimicrobial in food. It's probably citric, lactic and acetic acid, and sorbates.
> I did notice that my debian-based system got noticeably slower and unresponsive at times the last two weeks, without obvious reasons. Could it be related?

Possible but unlikely.

> I read through the report, but what wasn't directly clear to me was: what does the exploit actually do?

It injects code that runs early during sshd connection establishment. Likely allowing remote code execution if you know the right magic to send to the server.
Gives me Minority Report vibes. Which…probably isn’t good.
It can lead to amusing cases where the intentional vuln comes in "to improve x" and the quiet fix comes in "to improve x".
Yes. For example "randomness." Seems mundane, but this simple intuitive concept can't actually be formally defined. I have yet to see an actual algorithm for a truly random number generator.

The profoundness comes from the fact that on the intuitive level we are all hyper aware of what random means. But on the formal level we have no idea what it is.
I want one so bad I've wanted one since I read Diamond Age I'm an adult but ahhh
It's weird and disturbing that this isn't the default perspective.
Reading Papers in Volume
Don't blame the guy. Could have happened to anyone. Even you.
Akinator (20?? - 2017)
After reading about the amateurs at eBay, I'm perfectly willing to entertain the idea that a large corporation who deals in military contracts might just take things one step further. Sure, I fully admit that I'm letting movie plots run wild in my head here, but I'm not ruling out the possibility. What, you think Rudolf Diesel just fell off that boat, too?

But it is all just conspiratorial at this point. Whether Diesel was pushed or fell, we'll never know and unfortunately won't for John Barnett, either.
Also see https://news.ycombinator.com/item?id=39865810
As long as this is not seen as justification to displace any other species just when we feel like it (because they probably displaced some other species), I can agree.
The modular one looks like Convergent Technologies/UNISYS CTOS modular systems. Cool idea, but no so practical, imagine each module required it's own (external) PSU!
Personal experience from travel in Iceland, Peru, UK (mostly Scotland), and Italy. Obviously generalizations and anecdotes, so take with a grain of salt.

Americans often stand out. Look more "touristy" - wearing shorts, goofy bags, unstylish footwear, etc. Most likely to ask "what do you do?" (for a living). Not rude, but can be more boisterous/social than some others.

Chinese - tend to travel in large tour groups. Frequently dressed poorly for conditions (Jimmy Choo shoes while touring Icelandic waterfalls). Disembark from buses and race to get a selfie before the rest of the crowd. Not purposefully rude, but the sheer number/concentration of them makes them stand out.

Europeans are generally don't stand out. Usually dress the least obviously touristy. Usually happy to make chit-chat, but less likely to initiate than US-Americans.

And stupid people come from all backgrounds. While in Iceland, there was an Asian fellow who insisted on sticking his hand into the geysers, despite warning signs in ~8 languages. Same trip, some German teens ran out onto an icy lake, despite signs warning of falling through the ice. And at the big waterfalls, there were people from all races/nationalities jumping fences to get better shots for their Insta feeds.

My personal pet peeve is people who litter or otherwise ruin natural beauty. And again, they come in all shapes, sizes, colors, creeds, etc.
I haven't gone through that source in detail, but I would assume that includes people who pled guilty, felony murder (ie they didn't directly kill someone, were just involved in a different felony that resulted in someone's death), crimes of passion and other cases where lighter sentences are justified.
BI tools haven't been going in this direction. They are moving towards helping you understand your data or embed your dashboards. It's a lot of focus on understanding and monitoring, but not communicating or storytelling. That is where we want to step in.
Thank you, jj.
Even that...Everybody better get their own Certificate Authority and a family password.
what if praying uses spooky action at a distance and isn't bound by the speed of light?
This account changed the instructions for reporting security issues in the xz github as their very last commit:

commit af071ef7702debef4f1d324616a0137a5001c14c (HEAD -> master, origin/master, origin/HEAD)
Author: Jia Tan <jiat0218@gmail.com>
Date: Tue Mar 26 01:50:02 2024 +0800

Docs: Simplify SECURITY.md.

diff --git a/.github/SECURITY.md b/.github/SECURITY.md
index e9b3458a..9ddfe8e9 100644
--- a/.github/SECURITY.md
+++ b/.github/SECURITY.md
@@ -16,13 +16,7 @@ the chance that the exploit will be used before a patch is released.
You may submit a report by emailing us at
[xz@tukaani.org](mailto:xz@tukaani.org), or through
[Security Advisories](https://github.com/tukaani-project/xz/security/advisories/new).
-While both options are available, we prefer email. In any case, please
-provide a clear description of the vulnerability including:
-
-- Affected versions of XZ Utils
-- Estimated severity (low, moderate, high, critical)
-- Steps to recreate the vulnerability
-- All relevant files (core dumps, build logs, input files, etc.)
+While both options are available, we prefer email.

This project is maintained by a team of volunteers on a reasonable-effort
basis. As such, please give us 90 days to work on a fix before

Seems innocuous, but maybe they were planning further changes.
Yesterday sure was fun wasn't it :p Thanks for all your help/working with me on getting this cleaned up in Fedora.
In what way? "Beowulf clusters" were built out of off-the-shelf machines connected through relatively normal (if high-speed) networking, running MPI programs on Linux. That's what distinguished them from the more expensive, more custom HPC systems of the day.
You can get 5g extenders.

For example, if your connection is bad, some provider offer indoor 5G stations. Not sure how they deal with the license in that case