skysight-inc/HackerNews huggingface dataset:
Each their own, that's mine. Note that this is not a tech user or developper list, but the list of what I install on any new windows pc, including those at work etc ...

7zip (open any archive)

VLC (open any audio/video file)

IrfanView (+ the "all plugins" installer on the same page, open any picture file)

SumatraPDF (read PDFs)

Libreoffice (to open any office files)

NAPS2 (easy scan, and split/merge/... PDFs)

Ditto (give your clipboard a memory)

Everything (an instant file search that works)

TeraCopy (replace windows copy with queue, queues, add files to the queue instead of starting a second parallel copy, pause that works, ...)

Powertoys (so many to list ... mass rename file easily, screen ruler, text extractor ...)

If it's appropriate : Qbittorent (clean torrent client)

Nvidia graphic card ? NVCleaninstall, so you can install just the clean driver you need

Windows 10 or 11 ? O&O Shut Up (to disable all the telemetry and onedrive in one click, there are plenty alternatives but I sort of like this one)

Windows 11 ? ExplorerPatcher to remove suggestions in the start menu and the new and terrible castrated contextual menu

And of course your browser of choice and extensions

In ten minutes you have a computer that feels much more smart and usable. There are plenty of great software out there, but I feel like many what to install lists are very topical or include software you won't use in many cases or once every 6 months, so this is my short list of what you will use essentially every time you use the computer.
> But seriously, we could have found ourselves with this in all stable repos: RHEL, Debian, Ubuntu, IoT devices 5 years from now and it would have been a much larger shit show.

Think about backdoors that are already present and will never be found out.
white space as a delimiter is why i never use python.
No, seriously, one of our PMs was clearly as dumb as a metaphor for something really dumb. Rhodes scholar too, which shows you what that's worth these days.
Vacuum bags are good for storing that kind of stuff compactly. My duvet and duvet covers semi-permanently live in one! The only kind of blanket I’ve found that is not too warm is gauze.
Shannon entropy and Kolmogorov complexity are absolutely literally the same thing though! They are both purely theoretical and you cannot calculate the minimum Shannon entropy any better than you can calculate the Kolmogorov complexity. In fact if you could calculate one you could calculate the other trivially but we don't have a way to do that.

For those now thinking about how to calculate Shannon entropy using the defined formula what are you using for the symbols? If you used one bit symbols of '1' and '0' and a probability of each appearing a file that was just 11101110... repeating would you would find a different Shannon entropy to someone using 4 bit symbols. Shannon entropy is literally uncomputable in the real world. You can only compute it if you are given a fixed alphabet and frequencies but in the real world the optimal alphabet for a given file to calculate the minimum Shannon entropy is actually unknowable.

That's where Kolmogorov complexity comes in. It states that "well we don't actually have a way to define the alphabet in Shannon entropy in the real world but if we pretend we have a system (the universal computation) we could calculate it". They then add in the size of the program length that does the calculation as well to prevent cheating by having a language that has a dictionary specific to the thing to encode and call that Kolmogorov complexity. But that's it. They are literally the same thing in essence.

Kolmogorov complexity is in fact better than Shannon entropy for real world usage. It's every bit as computable in the real world (ie. not at all but at the very least you can do the best compression you can and make a guess!) but it at least states that upfront.

For anyone wanting to claim that they had a CS assignment to calculate Shannon entropy and it's totally computable your teacher should probably have explained that the symbol frequencies for the alphabet given aren't actually computable like that in the real world as the optimal symbol lengths themselves aren't actually computable. You cannot in the real world just say "compute the Shannon entropy of an alphabet with two symbols - B 30% and A 70%" because you don't actually know if B and A are the optimal alphabet to define to minimize Shannon entropy. BBBAAAAAAA repeated has no entropy but it fits the definition of the question given and would give you a different result.
New Features in React v19
I still use IrfanView to this day, all the way back since mid 90'ies. It's a fantastic piece of software with a great legacy and I wouldn't trade it for any modern photo software. So snappy and functional, works like a charm. With the plugins added to it you can open literally any image.
More likely people (criminals) realized consumers can't protect themselves from near complete fakes and someone's out there making bank.
I bet it’s not that unpopular. It’s a very impressive attack in many ways:

- It’s subtle.

- It was built to over several years.

- If the attacker hadn’t screwed up the with the weird performance hit that triggered investigation (my dramatic theory: the attacker was horrified at the infonuclear bomb they were detonating and deliberately messed up), we likely wouldn’t know about it.

You can detest the end result while appreciating the complexity of the attack.
If you look at the diagram of privsep, the authentication process is part of the privileged binary, which is where this RCE lives

http://www.citi.umich.edu/u/provos/ssh/priv.jpg
Presumably because other people can also utilize the “bug” they create intentionally but looking inadvertently. This backdoor however is activated by the private key only the attacker has so it’s airtight.
The strategy on printers has largely been, “lose money on their hardware and make it back on the ink.” If you were to go to market against them you would be competing with something that is already losing money. For your average consumer it’s probably not worth buying a machine that is 10x better for 20x the price.
FYI, Irfanview might not be able to pull it from an url, but it's playing ful hd video just fine although I wouldn't use it for that.
In jetbrain products, you can select any bloc of code and show the git history for this particular bloc.
I don’t know exactly which command is behind it but I always thought it would be tedious to do it manually like you described
Another analysis locates Jia in Eastern Europe:
https://rheaeve.substack.com/p/xz-backdoor-times-damned-time...

But I would like to see analysis of timestamp of GitHub events (like PRs and comments timestamps) which are harder to fake.
Landscape architect Kongjian Yu has a plan for urban flooding: 'Sponge Cities'
Maybe 30s here, but I'm not claiming to be the fastest; I'm wondering if body length is a factor. As a somewhat tall person (189cm) in my 50s I never had any issues changing doona covers.

Had a much shorter girlfriend at one point who simply said "that's not fair" when she saw me do it.
Seems off. How many devs are there as % of population that moved to a rural area and purchased a house in 2020/21?
I don't think we'll get a choice. LLMs do that sort of thing far better than us. It's a 'be careful what you wish for' monkey's paw.
https://archive.ph/qLtQF
It’s by design. The job of autotools is to find “ground truth” about whatever environment you’re compiling against. It’s meant to discover if you can use a feature by actually seeing whether it works, not just by allow-listing a known set of compiler or library versions. This is because the whole point is to allow porting code to any environment where it’ll work, even on compilers you don’t know about. Think back to a time when there were several dozen Unix vendors, and just as many compilers. You don’t want your build script to report it can’t compile something just because it isn’t aware of your particular Unix vendor… you want it to only fail if the thing it’s trying to do actually doesn’t work. The only way to do this is by just testing if certain code compiles and produces the expected result.
Yeah. It would be interesting to see who adopted to the compromised versions and how quickly, compared to how quickly they normally adopt new versions (not bots pulling upgrades, but how quickly maintainers approve and merge them)

If there were a bunch of people who adopted it abnormally fast compared to usual, might point to there being more "bad actors" in this operation (said at the risk of sounding paranoid if this turns out to be a state run thing)
That sounds like you think I'm calling @krapp a member of the set "idiots"; I'm not — ironic that at least one of the two of us is misunderstanding the other, given the question of LLMs not understanding things — rather I'm saying there are many temporarily-idiotic in the world (myself included :P) and I have worked with enough of them to not dismiss the mistakes that LLMs make as a dramatic departure from this.
I also downloaded the report, and while I only skimmed it, I came to a similar conclusion. This doesn't mean that there isn't gender disparity of pay in tech, but it doesn't seem to be well supported by that particular report.

But for me, this is why it's even more important to discuss the article rather than preventing the discussion. As it is, people will remain entrenched in the impression they get from the headline. Allowing discussion (even and especially critical discussion) helps people's thinking to evolve.

If not clear, I'm fairly far on the "free speech" side of things. While there are legitimate reasons to declare certain areas off-topic here, I don't think there should be any viewpoint censorship. We should strive to understand the truth, even if that truth is uncomfortable.
Knuth's famous paper "The Complexity of Songs" (1977) deserves a mention. He describes how most songs of length n require a text of length proportional to n. But he goes on to prove the complexity of Old MacDonald had a farm as O(sqrt(n)), the complexity improvement of Twelve days of Christmas, the O(log n) song 99 bottles of beer on the wall, and finally the O(1) song That's the way I like it by KC and the Sunshine Band.

https://dl.acm.org/doi/pdf/10.1145/1008354.1008355

Also, the linked Science article is just a summary. The full paper (not paywalled) is at: https://www.nature.com/articles/s41598-024-55742-x
How Does Russia Make Missiles?
> white space as a delimiter is why i never use python.

Whitespace is a delimiter in (almost?) all languages humans use.

Whitespace determining which scope you’re in is one of the many problems of making whitespace significant, which might be what you meant.
... if we want security it needs trust anyway. it doesn't matter if it's amazing Code GPT or Chad NSA, the PR needs to be reviewed by someone we trust.

it's the trust that's the problem.

web of trust purists were right just ahead of the time.
Not this kind!

See for example page 35 in the Justice Department’s computer crimes handbook (dated, but basically AIUI the same way they still do things) [0]

[0] https://www.justice.gov/d9/criminal-ccips/legacy/2015/01/14/...
Why would the FBI investigate the NSA? We have zero idea who the actors involved are.
Why would open source models make this scenario you are painting better?
Nvidia\Microsoft\Apple

Nvidia has a huge moat and demand for compute in 10 years will be like 1 million x or more what it is now.

Microsoft will anti-competitively bake AI into the OS; then release a smartphone with AI baked into it and integrate it into everything else and clobber Google/Android. Apple for similar reasons, whatever works for MS they will also do eventually.
Yes and that is yet another case for encapsulation.

For me, it is an antipattern for a short lived task to be directly creating long lived resources. Async work ideally is scheduled using message passing to the task manager which may have its own memory management strategy (heck, the background task may well be written in an entirely different language).

I just feel that it is very common to have large portions of the application that fit the model of read input/write output, free all intermediate data upon completion. Due to a lack of encapsulation, however, we put unnecessary pressure on the allocator or garbage collector by mixing the short and long lived parts of our applications.
Grab any 1950's "how to be a good housewife" book, use a bit of scripting to replace "housewife" with "housekeeper" and "husband" with "partner", and republish.
Who says it was just the one library though?
It would be really cool if in 20 years when we have quantum computers powerful enough we could see what this exploit does.
folds sheets in the dark
"The CTO is the chief engineer" is both false and somewhat circular. It's false because plenty of "CTOs" --- maybe most of them! --- work outside the engineering organization, and are more closely aligned with product management than software development (CTO is very often a customer-facing "role"). It's circular because it leaves open the question of what a "chief engineer" is.

I worry that a lot of HN "CTO discourse" is really wishcasting, about what an "if I was monarch of all the developers" role would be (and then about what it's like to aspire to such a role). No healthy engineering team has such a person!
I often find that, with a new popular song I haven't heard before, I can correctly guess the next line of lyrics.
This feels very targeted
> Furthermore, the idea that plugins could've been in Rust or Rust through WASM meant that I'd have an editor which was completely hackable in the least annoying way possible. Every time I have to learn one of these tool-specific languages I end up breathing a heavy sigh, spending a lot of time relearning things or working around weird quirks, and then ultimately giving up after writing the most basic version of what I want to do.

I very much understand this. However I'd argue using Scheme is a great tradeoff. Because in the end programming is about tradeoffs.
Scheme will not overcomplicate plugins for the maintainers, and as a write you have to learn a tiny DSL for configuring your editor.

As we speak, I'm trying to write a plugin for Zed, and as awesome all the niceties about Zed is, plugins are not easy, and frankly speaking, I feel like I wasted my time with all this nonsense about WASM, while in Helix the same plugin (language support) was really, really simple, even as somebody who knew nothing about Rust or Scheme.
What were you using for RDP server on Ubuntu? was it xrdp?
Wikisource as well, where one can choose HTML, ePub, or PDF on most documents.

Other sites permit one to append ".json" for a raw JSON feed.
SE Linux comment by @poettering, https://news.ycombinator.com/item?id=39867126

> Libselinux pulls in liblzma too and gets linked into tons more programs than libsystemd. And will end up in sshd too (at the very least via libpam/pam_selinux). And most of the really big distros tend do support selinux at least to some level. Hence systemd or not, sshd remains vulnerable by this specific attack.

Devuan comment by @capitainenemo, https://news.ycombinator.com/item?id=39866190

> The sshd in Devuan does link to a libsystemd stub - this is to cut down on their maintenance of upstream packages. However that stub does not link to lzma.

Future proofing, https://gynvael.coldwind.pl/?lang=en&id=782

Stage 2 "extension" mechanism

This whole thing basically looks like an "extension/patching" system that would allow adding future scripts to be run in the context of Stage 2, without having to modify the original payload-carrying test files. Which makes sense, as modyfing a "bad" and "good" test files over and over again is pretty suspicious. So the plan seemed to be to just add new test files instead, which would have been picked up, deciphered, and executed.
What does the IME or PSP do?
Google and Azure have their own PDF Table extraction service but I have noticed Textract is a bit better.
rxzec
Trust me, you're kid is smarter than average simply by virtue of you posting here.
there are other ways for liblzma to get into ssh (via PAM and libselinux)
>Even though sshd must run as root (in the usual case), it doesn't need unfettered access to kernel memory, most of the filesystem, most other processes, etc

This is sort of overlooking the problem. While true, the processes spawned by sshd do need to be able to do all these things and so even if you did sandbox it, preserving functionality would all but guarantee an escape is trivial (...just spawn bash?).
> I learned that hard work and long hours does not guarantee success

Working smart is much more effective.
Or very untargeted. Something intended just to lay dormant by chance if succeeded...

It is very good backdoor to have if you at whatever time have dozens of options. See sshd running, test this you are done if it works, if not move to something else.
Were those 8-bit bytes?
The slowdown is actually in the startup of the backdoor, not when it's actually performing authentication. Note how in the original report even sshd -h (called in the right environment to circumvent countermeasures) is slow.
Wild guess, but it could be that whoever was behind this was highly motivated but didn't have the skill required to find zerodays and didn't have the connections required to buy them (and distrusted the come one come all marketplaces I assume must exist).
It’s also tricky to reason about risk: for example, ShellShock caused a bunch of vulnerabilities in things which used shell scripts and the classic SysV Init system was a factor in a ton of vulnerabilities over the years because not having a standard way to do things like drop privileges or namespace things, manage processes, difficulties around managing chroot, etc. meant that you had a bunch of people implementing code which ran with elevated privileges because it needed to do things like bind to a low network port and they either had vulnerabilities in the privileged part or messed up some detail. I think in general it’s been much better in the systemd era where so much of that is builtin but I have been happy to see them starting to trim some of the things like the compression format bindings and I expect this will spur more.
servers hosting gcc binaries are accessed using ssh
Because titles are important to some, and can be used as an incentive to lure people in.
HN guidelines:

> Please don't post shallow dismissals, especially of other people's work.
That’s how I got started — 7400 TTL chips are very forgiving to a young person’s hand.

I was amazed you could just write away to National and the day’s send back a databook! I would pour over them and think of ways to use various chips.
They seem to be largely modeling after the launched idea of the Sega CD, even more restrictively in some aspects e.g. CPU expansion. The Sega CD released 3 years prior to the given timeframe and offered just shy of 1 MB RAM with the same proposed CD + multi-disc support. The main improvement being the speed of the drive (The '91 Sega CD was 1x instead of 4x) and yeah, they don't do that over a literal CD drive but that seems to have more to do with not wanting to make a literal CD drive the same as using an FPGA isn't about using FPGAs as much as not needing literal ASICs be made.

It's important to note they are talking about an imagined expansion to the system in 1994, not an alternative version of the console released in 1985. It's reasonably feasible to do something of this level at the time the question is more one of "would it really be sensible". With the SNES already being 4 years old at this point and the PlayStation releasing that same year anyways (with twice the RAM, 2x CD support, and a hell of a lot more compute) I can't think anyone would bother. At the same time, the project is explicitly not measuring by what people bothered with at the time and rather what the reasonable limits could have been.
Maybe it's also that, now that there's no longer a taboo, more people are realizing how outright obnoxious smoking weed is? It seems worse than tobacco ever was, but that's probably a result of poor memory.
Maybe something like this [1] cell phone that looks like a traditional landline phone would do?

[1] https://www.amazon.com/Opis-Technology-Cellphone-Push-Button...
I used the git repo at https://git.phial.org/d6/xz-analysis-mirror/commits/branch/m... and simply did

git log --format=%cd --author="Jia Tan"

and then processed it a bit with gnuplot. Should not be difficult to reproduce this graph, but I am not too much of a gnuplot wizard so I first preprocessed this into some different files in a REPL. Don't have the full code of what I did but it should not be difficult to reproduce, just parse the dates and look at the hours.
Curious how much of this is due to factors other than AI. The data is correlated, but at least for me, I'm not convinced of causation.

Also, I'm kind of surprised at the customer service numbers. Chatbots existed before ChatGPT. Are LLMs more effective than the previous solutions at decreasing escalation to humans? Or could it be other factors like the economy at large causing companies to make do with less customer service?
In Python, you only need to indent the `def test_foo` by an additional whitespace, to make it a locally scoped function instead of a proper test function.
I think this is both right and wrong. Granting Sturgeon's law, most code is bad and hard to read and type annotations will usually help. On the other hand, in code that is very well written, type annotations are largely redundant visual clutter that do not improve the readability.

I'd say that for most people, use annotations most of the time is good advice, but there are exceptions and people should refrain from casting judgment on other's work due to a dogmatic instance on others using their preferred style.
Using an SSH key used with GitHub for other purposes than GitHub is not a good practice (even if it's common).

https://github.com/dolmen/github-keygen
If CFAA doesn't get this guy behind bars then the CFAA is somehow even worse. Not only is it an overbroad and confusing law, it's also not broad enough to actually handcuff people who write malicious code.
Generally speaking with Ottawa these days, the default expectation to every time a promise is made that sounds good for the media is that nothing will be done after the announcement.

I feel that is a cynical take and I defend against cynicism; however I think the government is more cynical that announcements are the only thing that matters. So it’s a question of whose cynicism should I defend against?
Like that spiderman meme, it's all the NSA
I'd be interested in some examples of where this "recruiting talent by offering to call them 'CTO'" strategy --- which I know has happened! --- has worked out, and what the actual role description for those "CTO"'s was.
I find myself doing that with songs and also with a lot of film and TV. I do it so often that it annoys my wife. At first she claimed that I simply watched the show before watching it with her, but for some reason I am able to guess the next words in the dialog more often than not.
https://news.ycombinator.com/item?id=39879559

> Libselinux pulls in liblzma too
Neither of those are true. The dental care is a $500 a year reimbursement for some children and seniors, and the pharmacare covers contraception and diabetes medication. There’s not even an expansion plan developed for either.
Back in the day when people compiled source from tarballs on their personal machines, the autoconf script would query your system to see what functionality it supported. It did this by trying to compile small programs for each feature. If the compilation failed it assumes the feature is unavailable on your system and a flag is set/unset for the rest of the build.
Because in the closed source model the frustrated developer that looked into this SSH slowness submits a ticket for the owner of the malicious code to dismiss.