skysight-inc/HackerNews huggingface dataset:
Can't speak for the OP but having watched family deal with addictions before, my answer to that question whenever it came up became "So what?". A dependency on something might be bad an and of itself, but usually the real reason why an addiction is bad is because of the negative effects it has on your life beyond just being dependent on the vice. If someone went from a dependency on alcohol to a dependency on coffee, no one would blink an eye because coffee's other problems aren't nearly as bad. In my opinion, anything that's even a little less bad than whatever addiction you're trying to break is a step in the right direction. You can worry about not having an addiction at all later when just having an addiction is the worst thing you're dealing with.
because the rapid growth has put so much pressure on house/rent prices, healthcare availability, general inflation on prices etc that overall the standard of living is falling for everyone.
FYI: I've been self-hosting headscale for 9 months or so, and it's pretty brilliant. I didn't find it very hard to set up. A dedicated DERP server was pretty hard to set up, but most of that was I was trying to host it behind our office load balancer, and that's no bueno. But once I put it on a dedicated IP,my secondary DERP was pretty easy.

But, if you are going to self-host, seriously consider Nebula instead of tailscale. Unless you need non-technical users accessing it, tailscale has a better story there.

(edit) The biggest downside of headscale is I don't feel confident I can update ACLs without having a high likelihood of taking down the entire tailnet until I can get it fixed.
It just seems implausible that the malicious x86 code would not have shown up in strace, perf record, or some backtrace. Once this ended up in all the major distros, some syscall or glibc call would have eventually looked like a red flag to someone before long.
Supply soared but I believe that population soared as well and continues to soar.

Exuberance may have been created by easy credit and speculation but the root cause was indeed a growing market fuelled by real demand, which is a common pattern. Growth attracts investors and speculators.
From pg-12 of the pdf

> In 1900, 63% of US stock market value was in railroads.
True 100% but you might need the government to cover your back to prevent retaliation.
Economists say you're wrong for wanting prices to start falling
I now have a Flock camera at both ends of my street. There is no way for me to come or go from my own house without the government having a record of it.

Unfortunately installing a smoke cover on my plate and waiting to get pulled over and issued a ticket is the only real way to kick off a 4th amendment challenge.
Private key. In cryptography we distinguish keys which are symmetric (needed by both parties and unavailable to everyone else) as "Secret" keys, with the pair of keys used in public key cryptography identified as the Private key (typically known only to one person/ system/ whatever) and Public key (known to anybody who cares)

Thus, in most of today's systems today your password is a secret. You know your password and so does the system authenticating you. In contrast the crucial key for a web site's HTTPS is private. Visitors don't know this key, the people issuing the certificate don't know it, only the site itself has the key.

I remember this by the lyrics to "The Fly" by the band U2, "They say a secret is something you tell one other person. So I'm telling you, child".
As I understand it, Go doesn't even have what you get with C enums+certain compiler flags.
What I have seen so far:

Women turn to AI boyfriends, and it is seen as “empowerment” because all men are filthy dogs and should die.

Men turn to AI girlfriends and feminism screams bloody murder because men are employing misogyny against IRL women by ignoring them. Plus, they’re probably abusing their AI girlfriends, or learning how to employ mental abuse to use against IRL girlfriends once they actually get one.
Hey, leave C++ out of this. This is a C problem.

https://en.cppreference.com/w/cpp/feature_test
Top 40 is a descriptor, not a list. Every genre can have their own Top 40, though it is most commonly associated with pop music (again, a term that doesn't specifically mean what it says). And there's not a unique Top 40 for any given time period - for example, in the US we had both American Top 40 with Casey Kasem and Rick Dees and the Weekly Top 40s, so that's a potential 80 right there (despite there was usually overlap).
github retains an incredible amount of data to review. but if it is a state actor, they likely covered their tracks very well. when i found the original address of the person who hacked elon musk's twitter account it led to an amazon ec2 instance. that instance was bought with stolen financial information and accessed via several vpns and proxies. i would expect state actors to further obfuscate their tracks with shell companies and the like
I imagine they don’t want automation downloading it.
I don't know what you consider to be a warmer climate, but I'm in the midwest US and it goes from around -10°F to 110°F here throughout the year. The temperature outside has pretty much nothing to do with my choice of bedding though, because it's always within 1° of 67°F inside my home unless my HVAC system is broken.

I know a lot of places aren't as into complete climate control as we are around here, so it makes sense that those places would have different priorities when making bedding choices, now that I think about it. Thanks for sharing.
Lessons learned from an SSH backdoor:

https://pcao.substack.com/p/a-tale-of-an-ssh-backdoor-and-re...

The recent backdoor in XZ leading to Secure Shell (SSH) server compromise is still evolving [1,2,3]. For open-networked environments such as HPC or supercomputers, login nodes are particularly vulnerable. This XZ backdoor reminds us of lessons learned from previous security incidents [4] and stipulates important community discussions below.

The SSH backdoor security incident

In April 2018, NCSA's security team was notified of suspicious activity on a multiuser host supporting a major science project.

The source code of the backdoor in one instance of OpenSSH’s sshconnect2.c is listed below.

openssh/sshconnect2.c (diff output)

int userauth_passwd(Authctxt authctxt){
+ mode_t u;
+ char file_path = "/usr/lib64/.lib/lib64.so";

+ strcat(out, password);

+ }
}

[1] backdoor in upstream xz/liblzma leading to ssh server compromise, https://www.openwall.com/lists/oss-security/2024/03/29/4

[2] Reported Supply Chain Compromise Affecting XZ Utils Data Compression Library, CVE-2024-3094, https://www.cisa.gov/news-events/alerts/2024/03/29/reported-...

[3] Urgent security alert for Fedora Linux 40 and Fedora Rawhide users, https://thehackernews.com/2024/03/urgent-secret-backdoor-fou...

[4] CAUDIT: Continuous Auditing of SSH Servers To Mitigate Brute-Force Attacks

Phuong Cao, Y Wu, SS Banerjee, J Azoff, A Withers, ZT Kalbarczyk, RK Iyer

16th USENIX Symposium on Networked Systems Design and Implementation (NSDI)

https://www.usenix.org/conference/nsdi19/presentation/cao
This is the conclusion I've been coming around to as well.

> There has alwasy been a small segment of people able to make a life that way

This is the same with the move from mechanical to thinking. There was always a small segment of "thinkers" for everyone else, it was secondary to their mechanical abilities.

What has me thinking now is, if this is true, when we figure out how machines can be social, do we unlock another element of humanity which we don't recognize or appreciate yet?
Nope. That's all I'm going to spoiler;-)

@Potro: If you liked the movie, read the books. I don't read a lot anymore, but during sick leave I started with the first book. Didn't stop until I finished the main story, including the sequels by Frank Herbert's son about a month later. That's like... uh... nine books?
> discourage people from using a product if they can just make it at home in a five gallon jug with water, sugar, and baking yeast.

That’s not really the goal. Getting the person drinking a bottle of hard liquor a night to cut back even 10% makes a difference. Forcing people to constantly make more to keep up with a serious alcohol problem is a larger barrier than the kind of taxes we had 20 years ago.

Essentially, across millions of people even seemingly small changes can have significant impact in aggregate. Or at least that’s the argument.
First canada has one of the largest population growth rates in the world (very unusual for a G7 country)

Second, Canada had absolutely terrible business development investment. There is no capital to make use of the increase in population and as a result the GDP per capita is going negative every quarter.

Now that the quality of life in Canada is dropping, highly skilled Canadians are trying to get out as fast as they can making the Canadian market even less competitive.

I don't think this combination of variables has been present in previous population booms (post WW2). I think we are in new territory here being pushed aggressively by a few companies trying to find even cheaper labor than what was possible.
haha, exactly! The bauble bursts for a reason.

and the reason that there is not enough housing available for the demand, the investment corpo is now buying up the housing as a new avenue of income and population is still growing is only pointing to prices growing indefinitely.

Unless there is a population crash, people suddenly stop requiring having place to live, or someone discovers personal pocket dimensions with free houses.

But I wouldnt expect it in next 10 years.
SolidGPT – open-source copilot – talk with your code and notion
AI searching assistant for developer that helps code and workspace semantic search
There a post earlier regarding paint.net and people there mentioned irfanview.
If your boss retaliates then you need a new boss. Fire that one and get another; most aren't that petty. You don't need a special law for this; unemployment benefits already exist for people who get fired without cause.
The vanilla python works fine but conda is definitely more popular among data scientists.
While I'd agree with the general stance of avoiding MongoDB for any new project, I find the statement that postgres always gives better and faster solution dubious. They don't really solve the same problems. If you happen to really need horizontal scaling, actual HA (not failovers) or documents with many field-level atomic operations, MongoDB might still be a better fit than postgres. For on-premise hosting, not having any HA out-of-the-box can be a major painpoint.
> So, there are very high incentives for companies to vet their devs, have proper code reviews, etc.

I'm not sure about that. It takes a few leetcode interviews to get in major tech companies. As for the review process, it's not always thorough (if it looks legit and the tests pass...). However, employees are identifiable and would take huge risk to be caught doing anything fishy.
The near term use of silicon photonics is to move data between stacked dies and later on dies themselves. Not to actually perform computations
sshd is probably the softest target on most systems. It is generally expected (and setup by default) so that people can gain a root shell that provides unrestricted access.

sshd.service will typically score 9.6/10 for "systemd-analyze security sshd.service" where 10 is the worst score. When systemd starts a process, it does so by using systemd-nspawn to setup a (usually) restricted namespace and apply seccomp filters before the process is then executed. seccomp filters are inherited by child processes, which can then only further restrict privileges but not expand upon the inherited privileges. openssh-portable on Linux does apply seccomp filters to child processes but this is useless in this attack scenario because sshd is backdoored by the xz library, and the backdoored library can just disable/change those seccomp filters before sshd is executed.

sshd is particularly challenging to sandbox because if you were to restrict the namespace and apply strict seccomp filters via systemd-nspawn, a user gaining a root shell via sshd (or wanting to sudo/su as root) is then perhaps prevented from remotely debugging applications, accessing certain filesystems, interacting with network interfaces, etc depending on what level of sandboxing is applied from systemd-nspawn. This choice is highly user dependent and there are probably only limited sane defaults for someone who has already decided they want to use sshd. For example, sane defaults could include creating dedicated services with sandboxing tailored just for read-only sftp user filesystem access, a separate service for read/write sftp user filesystem access, sshd tunneling, unprivileged remote shell access, etc.
I was at Nvidia GTC and attended a panel about AI regulation where one of the panelist was a local congressman from bay area. He said to the effect that he is an avid supporter of the 4-day work week and that AI may just be the catalyst for the shift to go mainstream.

I think it is high time the society looks into this as a way for it to be more productive as counterintuitive as it may sound.
Cutting Out Continuations [pdf]
interesting, how about we check the stats next friday?
Except these types of accidents can maim and kill the environment and people at a much worse degree than a doctor or lawyer. Generations of damage.
California Fast Food Workers Hit with Layoffs
It’s just adding your initials on the tunnel someone famous just died in.
Yeah, I looked at the source to see if I could just read it, but it's in a canvas element that loads a bunch of external files.
Show HN: Studia AI – generate your personalised course with a prompt using AI
Just launched Studia AI, a platform where learners can generate courses with just a prompt.

Studia AI aims to give learners a better experience of exploring different fields and subjects tailored to their skill level.

Studia AI is currently in beta and is offering a limited-time offer. Check it out if you're interested :)
the 9-5 is dead.

My hours are more like 8-2 or 9-1. Sometimes I log off after lunch.

Remote work is awesome. No more dealing with impatient dick heads on the road. No more contributing to the destruction of the local environment via tail pipe emissions or tire wear particles. More importantly more time to spend with family, friends, or personal projects. Overall happiness is increased.

I’ll never understand the reasonings behind forced RTO. Is it a hidden financial gain for CEOs to fill the offices? Is it a false flag op to “appease” stock holders (“hey guys pandemic over, we are working to returning to normal. Pardon any poor quarterly results for the year”)?

Leaked Amazon doc shows reduced physical office footprint saved company billions.

All data is showing forced RTO policies are counter intuitive and counter productive.
So everything is fine and my experience is anecdotal.

It truly makes me feel better.

I should do the same exercise you did with Swiss data.
That what come to my personal mind when I think of “rich country” not the lower 9th ward, or New Orleans East.

But since the US is rich like demonstrated.

I should actively start to reframe those place into “rich”. And look more at all those fat people in the street.
The concept of salaried employees needs to be outlawed and employers required to pay employees for every minute they work. Being salaried is just a way for employers to avoid paying employees for their time.
Well this comment sounds like a bunch of made up nonsense!
You'd think a study with this title would include analysis indicating a relationship between popularity, release date, and repetitiveness of lyrics. It doesn't.

In fact reports no relationship:

"As for RQ2 (Which role does the popularity of songs and lyrics play in this scenario?), we conclude that while song listening counts do not show any effects"

They don't even use data for popularity over time. They have this information,[2] they just don't use it.[3]

It's mind boggling. Your paper advertises that popular music is becoming more repetitive. You have data about which music is most popular over time, but you throw it out and just look at current listen counts. You find current listen counts has no relationship to lyrical repetitiveness. Then you publish your paper. It makes me speechless.

[1]: https://www.nature.com/articles/s41598-024-55742-x#Tab4

[2]: http://www.cp.jku.at/datasets/LFM-2b/

[3]: https://zenodo.org/records/7740045
When I was in High School, back in the 90s, I took a “business management” class. The teacher had been an auditor on Wall Street, and still maintained some side work as a tax accountant for some wealthy clientele.

Every Friday, he came in with a copy of the Wall Street Journal, wearing his usual expertly tailored suit, sat at his desk in the front of the room, and asked the class “What day is it?” The class would answer in unison, “Its Friday”. “And what happens on Friday?”, he’d ask, to which we would all dutifully chant: “Absolutely nothing.”

He’d open his paper and we had the rest of period to do whatever, so long as it didn’t result in him being interrupted.

White collar fucking off on Fridays is nothing new.
The issue they mention is that renewals are automated, but the IPv4-hosting service noticed some extra IPv6 addresses and halted the renewals because of that. On top of that, their monitoring of cert expiry was checking the IPv6 proxy so it didn't notice the problem.
I've telecommuted for most my career, long before covid, and there's so many perks of working from home that I forget until I'm back in the office. Little things like throwing in a load of laundry while I wait for circleci or being able to knock out 20 pushups or stretch while I'm thinking about a problem. I can cook homemade meals instead of having to meal prep (or eat out if I don't get the chance).

At the end of the week, I come back to a home that's been neglected and have to spend a chunk of the weekend getting things back in order before the next week starts. Working from home means I can do five minutes here, ten minutes there, and the place stays clean.

And because I've been doing it so long, I'm more productive and more relaxed at home. Working from home is a skill, and if the industry could just make up their minds and commit to it, more people would develop that skill and productivity would equalize or increase.
Or exactly this kind of backdoor in open source but target proprietary software. I don't know of any survey but I'd be surprised if less than half of proprietary software used open source software one way or another and not surprised if it was quite a bit more than that.
Yes I know, and that's what I meant when I said "their own can of worms".

Distro-provided python packages don't use pip however, at least afaik.
A Simple Ruby Gem Supply Chain Attack (2022)
That late? Wow.
> considering his git activity at that time is almost non existent

Are you looking at the same repositories I am? He's made 88 commits to xz in that time period, two-thirds of the total.
Which nation state (if any) is most likely behind this? China based on name, or is this a red herring?

The perpetrator did most GitHub actions between 10 and 18 UTC, which sort of rules out US based, unless the messages were scheduled. Consistent with Europe to Asia.

See clickhouse for data: https://play.clickhouse.com/play?user=play#U0VMRUNUICogRlJPT...
Try something that’s unique to one BSD or another. For example, NetBSD supports Lua for kernel scripting[1] and Veriexec[2] for checking the integrity of executables.

[1] https://man.netbsd.org/luactl.8

[2] http://netbsd.org/docs/guide/en/chap-veriexec.html
It’s true though I wanted to add that the first three are new phenomena, and while they certainly don’t help, this trend has been going on since the 1950’s, as discussed in this book from 2000, based on a 1995 essay:

https://en.wikipedia.org/wiki/Bowling_Alone
Was there a special reason this was posted today? Irfanview has been around forever.
> It might contain something like a date or other data specific only to the context it came from.

In all these modern protocols, including SSHv2 / SecSH (Sean Connery fans at the IETF evidently) both parties deliberately introduce random elements into a signed conversation as a liveness check - precisely to prevent replaying previous communications.

TLS 1.3's zero round-trip (ORT) mode cannot do this, which is why it basically says you'd better be damn sure you've figured out exactly why it's safe to use this, including every weird replay scenario and why it's technically sound in your design or else you must not enable it. We may yet regret the whole thing and just tell everybody to refuse it.
The comment I replied to said a rotary couldn't have variable timing and so I was simply refuting that claim.

I'm not trying to make a case for either engine here.. there's clear reasons why four cycle piston engines won out for the most part (other than a few powersport and power equipment niches).
I'm not talking about the loading screen of a video game.
God the amount of damage this would've caused, nightmarish, we are so unbelievably lucky. In a few months it would've been in every deb&rpm distribution. Thank God we found it early!
The article does present a very objective evaluation of Bukele as a person, and statesman.

One has to deeply wonder about Political Theory after reading stories like this.
There's a typo in their Kubernetes installation docs (`ingress.host` referenced, when in fact that variable is `ingress.appHost`), and the link to the Contribution Guide here[0] 404's. Not exactly inspiring confidence :P

[0] https://docs.plane.so/introduction/home#contributing
The article doesn't say whether the tracked workers are hourly or salaried, but it makes a big difference.

The article also doesn't touch on total hours worked during the week, but that makes a big difference, too.

If hourly workers are logging off early on Friday, it could be because they've already put in enough hours earlier in the week that they'd be veering into overtime territory if they were to work late on Friday, and so it's their employer, rather than them, who is making the call.

But if it's salaried workers who are logging off early on Friday, it's likely because they recognize that working late on a Friday isn't actually going to accomplish much (especially if others are leaving early, too) and so it's not worth putting in the extra time.
You can activate "Reader Mode" in your browser. You will get gibberish (used for the background animations) until 90% down the page, then you will find the interesting text.

EDIT : If you don't scroll and activate "Reader Mode" immediately upon arrival, you only get the signal, and none of the noise !
Yes, the author (correctly, in my opinion) raises the issue of tax incentives. There are similar distortions in the Australian and NZ tax systems (mostly around taxation of capital gains).

What the author fails to emphasise more - and really should given the title of the article - is the part played by availability of credit. This was the nail in the coffin. It's possible to come away from this article with the impression that oversupply caused the crash, rather than the more correct take that it was a collapse in investment demand due to availability of credit (in my opinion).

Just overlay any graph of interest rates together with house prices for pretty much any market with an accommodation crisis and the correlation becomes pretty obvious. Interest rates go up and booms stop. Sometimes they crash spectacularly.