skysight-inc/HackerNews huggingface dataset:
No one here has talked about the number of lives that Serra's work has claimed/ruined. So far: one death and two serious injuries. Details here: https://www.theguardian.com/artanddesign/shortcuts/2018/aug/...

From this link:

> Richard Serra’s steel sculptures feel the most dangerous of all. They tower over you, surround you, menace you. The danger is not illusory. Serra’s rolled steel is dangerous, especially for workers who have to install it. In 1971, a contractor called Raymond Johnson was killed during the installation of a Serra sculpture. In 1988, two workers were seriously injured while deinstalling one of his pieces.

We were taught to hate his work at school. Big, heavy, industrial... 'big willy' art I remember one lecturer calling it. However, I always liked his work, largely as a result of seeing it in person at the Tate Modern. I could feel the literal eight of his work as I walked through it: heavy sheets of metal balanced against each other. Peril was part of the price of admission.

The death/injuries victims were all art technicians: people tasked with installing the work. I used to work with such people, and their job is a fascinating one. I remember helping to scan a building with ground scanning radar in order to determine if it was strong enough to hold Anselm Kiefer's library of huge lead books:
https://www.wikiart.org/en/anselm-kiefer/the-high-priestess-...

It took a team of four men and a forklift truck just to turn the pages of these books.
Some companies run more complex things than download buttons.
You seem to have made quite a lot of assumptions about me.
> And what about mannerisms, like pronouncing "you all" as "y'all"?

In the US this is highly determined by location, to the point where the New York Times even built a cool quiz [0] that can guess where you're from pretty accurately based on a few dozen vocab questions. So there's a dataset out there that would allow you to handle most of this variance by simply plugging in a ZIP code for the person you're spoofing!

[0]https://archive.is/yodpA
VoiceCraft, which has been released open source a week or so ago, can do the same with 5-10sec audio and is pretty convincing. It's pretty fun to play around with: https://github.com/jasonppy/VoiceCraft
> … Or an accounting firm can do this to Enron’s books and it tells them where the fraud is. Or an aircraft manufacturer can throw in all the product documentation for their aircraft and all of their parts suppliers and the maintenance records too and turn it into a database. Or an international regulator could do the same for air traffic control regulations and incident reports. Or a global beverage manufacturer or a clothing and footwear company can do the same for their social media interactions. Or a gamer can do it for a video game walkthrough and ask “What do I have to to build item X?”

An excellent argument that global society has become too complex and we should return to a greater dependence on local communities and less complexity.

Instead of using AI, let's just take Enron down, reduce air travel, remove international trade except for some very crucial items, and DESTROY global beverage and clothing manufacturers. A pox on society those last two are.

As for video games, that seems like a stretch. There are plenty fine video games that were made before AI.
Murdering a random civilian and murdering a public official are also very different levels of damage, but we still outlaw and prosecute both of them. This is the same thing.

Not to mention, what constitutes a political leader? Just the upper echelon? What about local civil servants? Mayors, cops, judges? Are they gonna have a database of every public or political figure in the country? No they won't. This is absurd.
Thanks, that makes sense.

I think in my mind the whole chain was still

source code->compile->test->distribute

from a single repo which is obviously not the case.

It’s more like

source->package->test->ship to distros->compile->test->package->distribute
You're imagining things, there is no memory corruption mechanism. The payload is delivered into the process address space by dynamic linking through a shared dependency and hijacks a function via GNU_IFUNC.
> The simple answer is "don't skimp"

Yes, but then the budget then quickly rises to a point where a compact desktop such as a used Intel NUC is cheaper, on top of being far more powerful.
Why is this big news, there are open source models that can do this for quite some time , including recently released https://github.com/jasonppy/VoiceCraft
A small number of people with likely professional involvement in the Fedora project and possibly RHEL.

A supply chain attack serve as the basis for another supply chain attack.
Indeed, a relevant quotation!
That is kinda crazy - state actors don't need to care about that level of obfuscation. From a state's perspective the situation here would be simple - hire a smart & patriotic programmer to spend ~1+ years maintaining an important package, then they slip a backdoor in. There isn't any point in making it more complicated than that.

They don't even need plausible deniability, groups like the NSA have been caught spying on everyone and it doesn't hurt them all that much. The publicity isn't ideal. But it only confirms what we already new - turns out the spies are spying on people! Who knew.

There are probably dozens if not hundreds of this sort of attempt going on right now. I'd assume most don't get caught. Or go undetected for a many years which is good enough enough. If you have government money on the budget, it makes sense to go with large-volume low-effort attempts rather than try some sort of complex good-cop-bad-cop routine.
We went through something similar at Notion a few years ago and also chose to stick with RDS Postgres and build sharding logic in our application’s database client.

In both our case and Figma’s, sharding Postgres ASAP was of critical importance because of transaction ID wraparound threat or other capacity issues that promise hard days-long downtime. The kind of downtime that costs 10s of millions of dollars of brand damage alone. Possibly even company ending.

In such a situation, failure is not an option, and you must pick the least risky solution. Moving to an unmanaged cluster system and figuring out your own point-in-time backup/restore, access control provisioning, etc etc has a lot more unknown unknowns than sticking with the managed database vendor you know. The potential failure scenarios of Citus have scary worst cases - we get backup and restore wrong but it seems to work fine in test, then we move to Citus, then something breaks and we can’t restore from backup after all. It’s equally bad to mis-estimate the amount of time needed to bring up the new system. Let’s say you estimate 6 months to get parity with RDS built in features needed to survive disaster and start moving data over, but instead it takes 10 months. Is there enough time left to finish before going hard down? The clock is ticking. Staying with RDS keeps a whole class of new risk out of the picture.

At least here at Notion, NO ONE wanted to build something complicated for fun. We really wanted the company we’d spent years working for and on-call for to survive.

Our story: https://www.notion.so/blog/sharding-postgres-at-notion
East Asian names (Korean, Chinese, Japanese, etc.) can have a great deal of variation in surname/given name positioning.

In my app, I don't even try to separate them. I just give a single string that can handle UTF-8, and let the user do what they want.

However, I also don't need that data for tagging, sorting or anything else, so it's easy for me to say.
That was actually useful. Since I stopped logging in to YouTube, autoplaying the next video has been a PITA.
Invalid SMILES are beneficial rather than detrimental to chemical lang models
That's why I'm saying that people new to graphics should probably start with Dawn or wgpu nowadays. They follow the same shape as the modern native APIs, but in a more streamlined manner, and are portable to all of the major platforms without relying on Apples long-abandoned OpenGL implementation which is missing foundational features like compute shaders. If you go down the Rust route with wgpu then it doesn't even require delving into unsafe code.

From that starting point there's a natural progression to tackling raw Vulkan, D3D12 or Metal if you outgrow what the WebGPU libraries are capable of. If you start from OpenGL instead then you have to unlearn all the nonsensical abstractions it teaches you.
Thanks for the explanation, very helpful!
While I agree using 'VNC' is a little questionable, I do think their use case together with graphical docker containers is rather cool: https://github.com/kasmtech/workspaces-images
Paint.net is the one thing I missed when I switched from Windows to Mac when M1 came out.

It's a brilliant quick photo editor.

People say to use Pinta on Mac but it's not the same. The closest I've found is Pixelmator Pro, which is also awesome, but is not free and quite a bit heavier than Paint.net.
Downloading a setup file is not the way to bring down a site. My experience in the HDD era was that people laugh at you when you do a lot of requests like that but call the FBI on you (at least here in the States) if you insert a lot of random users into their database. (Each of those requires a transaction and each of those requires waiting for the disc to spin around unless they had a nice battery-backed write cache)
OpenGL does a lot of work you'd have to do manually on Vulkan. That's why it's beloved. I use it to write a game currently. It's really half an engine. The danger of deprecation is there though. The API itself is fine IMO, with DSA of course. Without DSA it's a shitty state machine.
I was 15, I have an older brother. He had the game, but of course it being CD and protection, I couldn't play it. He had one of his college mates round and I had just got FarCry working with some no-cd patch I found on some 47th page of Google from some moonspeak forum.

As my bro was heading to go out; I showed it to both of them as they were passing by.

I received kudos of coolness, and because I normally have music playing in the background, Gary Jules - Mad World started playing next in the playlist. Only for my brothers mate to go "Woah, I was just thinking about that song".

And that's my memory of FarCry.
This reminds me that my Gmail account is over 19 years old, and I'm still being asked for my birthday to confirm I'm over 18. Could you at least try a bit harder to justify abusing my data, dear Google?
So when are we going to stop pretending that OSS maintainers/projects are reaping what they sow when they "work for free" and give away their source code away using OSS licensed software, while large companies profit off of them? If they were paid more (or in some cases even actually paid), then they could afford to quit their day jobs, reducing burn out, they could actually hire a team of trusted vetted devs instead of relying on the goodwill of strangers who step up "just to help them out" and they could pay security researchers to vet their code.

Turns out burned out maintainers are a great attack vector and if you are willing to play the long game you can ingratiate yourself with the community with your seemingly innocuous contributions.
capability safety inhibits supply chain attacks. memory safety is a prerequisite, but it is not sufficient
I imagine they also have significant resources to contribute to dealing with breaches - eg, analysing past cookouts by the bad actor, designing mitigations, etc.
Agreed that the vetting of private people would be invasive and not a good use of resources. It would also not work for recently compromised accounts.

I’m also personally torn on how much we want giant private companies controlling more and more of the core compute infrastructure and software.

In an ideal world, the code and software itself would be automatically analyzed for malicious use cases in release and deployment pipelines, but that’s a magic hand wavy kind of ask of a huge magnitude and complexity.
On March 29, 1951 a pipe bomb exploded in Grand Central Terminal, first of many
You don’t consider Maps a Google product? I guess there was some tech acquisition part there.
"genetically modified bacteria that can break down this plastic"

Isn't there a huge risk that this bacteria would also break down the plastics that are in use, so cars would just melt away, all plastic parts that are currently needed would break. So general industrial collapse.

This sounds good when talking about land fills.

It doesn't sound so good when all technology stops working.
You mean the "Enable picture-in-picture video controls"?
So Apple already did this, for that reason though.

https://www.aarp.org/home-family/personal-technology/info-20...
Yeah, I had a lot of nVidia GPUs suddenly disappear mid-training when even nvidia-smi couldn't find them; this was on different systems (Linux) and only a reboot fixed it.

You don't want this kind of thing happening when it is running a filesystem.
X for XXX
This is my parenting philosophy.

I let my children use my old smartphones in very limited ways for tasks I consider beneficial.

Listening to podcasts made for children before bed. Listening to music. Sending monitored discord messages to their cousins. Using a toothbrushing app. Etc.

Typically no more than an hour or so a day.

My hope is that this teaches them how to use the technology in helpful ways, and this time typically replaces time spent passively watching TV.
The alternatives are _better_ but still not great. build.rs is much easier to read and audit, for example, but it’s definitely still the case that people probably skim past it. I know that the Rust community has been working on things like build sandboxing and I’d expect efforts to be a lot easier there than in a mess of m4/sh where everyone is afraid to break 4 decades of prior usage.
Your password is useless when it comes to hardware keyloggers.
We run yearly tests to see if people check for "extra hardware". Needles to say we have a very high failure rate.

It's hard to get a software keylooger installed on a corp. machine. It's easy to get physical access to the office or even their homes and install keyloggers all over the place and download the data via BT.
> I am not sure why this is being developed. The potential for misuse is so much greater than any possible beneficial use cases I can imagine.

It's being developed because for decades, tech companies have touted the supposed benefits of new technology and hidden the costs. It's been an avalanche effect of greater and greater technology for greater and greater costs. Only now, the costs are so great that people are starting to wake up.

When we look back in time to see the devastation wrough by technology, we won't look at AI as the starting point. It will be the smartphones, the 4G internet, and the 8K video that we so blindly accepted without ever considering the immense changes to society that they implied. AI may be the start of the end of reasonable society, but it is only the APEX of a phenomenon that has been happening ever since we accepted fossil fuel use without considering the implicates of climate change. It's an entire societal attitude.
This is definitely the case for me. The number one thing bringing down my quality of life is that my friends don't have time/money to do things and I'm worried about their physical, mental, and financial health.
> bookkeeping for __what__?

Bookiping for things that happen so fast and at such a small scale that our current technological tools cannot fully capture data with enough precision and accuracy for us to make an good model of the underlying behaviour.

Imagine you put a spinning ball on top of a frozen lake on a windy day. You are going to observe the ball spin continously towards the same orientation until several gusts of wind make it spin the other way around, and this goes on and on for hours. From the measurements of the wind and current spin of the ball, you can make a model that accurately and precisely predicts the spin of the ball on the almost frictionless frozen lake.

Now imagine your spinning ball is extremely small you can't even see it or any "wind" with any tools that you currently have, but you can still measure its spin to a certain precision. Now imagine this "wind" is so strong and volatile that the tools you have sometimes takes a somewhat accurate physical snapshot of it and sometimes it just misses the gust. You take a look at the somewhat accurate measured spin and it seems to have changed without any reason, but it was just because your tooling is not accurate and precise enough to capture all the quantum gusts of wind that influence the quantum ball, so it looks like the ball is changing its spin randomly, whist in reality, we just can't precisely measure whatever is influencing the ball's spin with our current tooling. The influences are there, it's just that our tooling can't capture them precisely and accurately enough.

To combat that, we continously measure the ball's spin and we are able to figure out a pattern, not a precise one (because again, our tooling is not precise and accurate enough), but a pattern based on probability of the ball being in a specific spin state, we can even combine this with our inaccurate measurements of the quantum wind and further improve the accuracy of the probability. But never to a precise pattern, because our tooling sometimes misses certain wind states that it looks like the ball chagend spin randomly.

If we had tools that precisely and accurately measured the ball's spin and the quantum wind, we would be able to build a precise and accurate model of the spin based on those measurements. But we can't, although, we still want to make science around these inaccurate measurements, and probability based patterns are just enough for the science we want to make.

The wave function is just the result of our lack of precise and accurate measuring tools and measuring methods at this quantum scale. And for now, it's good enough for the science we want to do.
It's not constant, most C projects don't have anywhere near the number of library dependencies seen in your typical cargo project. From a supply chain attack perspective, Rust and Node promote ecosystems that are total disasters.
That's cool observation.

It's a good reflex when you see the sum of two squares to think at the Circle.
Same reason why athletes don't need a practical application for their exhaustive training. Advancing the theoretical frontier is a goal in itself, and it occasionally brings us to new scientific paradigms.
You can imagine all the layers of obfuscation you want, but it doesn't seem necessary to explain what is going on here.
Isn't there a lot of extra energy needed for fracking and oil sands? Oil isn't all that cheap to extract anymore, it isn't just bubbling up. So doesn't this new process just have to be cheaper than the cost of extracting oil from oil sands.
Well, Rust doesn’t support dynamic linking. So this particular attack wouldn’t be possible with Rust in March 2024.

But it’s a moot point because there are undoubtedly other mechanisms a malicious maintainer could use to inject a vulnerability. Just not this exact one.
Do you know a different term that conveys the same idea and is similarly short?
"They trust me, dumb f*cks"
Yes they did. That is typical of tech companies: it's amazing that people actually believe it. But that's our societies attitude: new tech is an improvement. It's a faith stronger than most people have in their god(s).
Just reading the title unlocked memories for me. Far cry came out in my life at the peak of local competitive counter strike, 1.6 at the time... CS was everything to me at that point and I hated the people coming to the lan house to play far cry instead of being on the cs servers... I remember it looking great tho I never played it.
> As said, compression is used everywhere and in embedded systems, it touches a lot of critical stuff. And the project went straight for that since the beginning.

Uh, because it's a compression library?
A GPU seems overkill when the bottleneck is the I/O.
And that's where I say leaving HTTP 402 as a warning sign that the Internet should not be used for economically significant purposes was a grave mistake; those people ARE worried, and Internet censorship enforced through advertisement, credit card payment processing, and App Store reviewing process, driven by those people, is getting us barreling down that road towards 1984/BNW.

Pornography aside, YouTube had effectively removed "die" from vocabulary in some languages through that, and people are adapting by changing accents. Soon it'll be a shibboleth. We're literally living 1984.
I appreciate the gift link
>>Companies abuse the consumer with greedy monetization practices and intrusive DRM

I'm sorry, have we already forgotten that 20 years ago you had crazy intrusive DRM that would only let your game run if your CD read successfully, if you had even a scratch on the disc goodbye game. And before that the same crap with floppy disks, where developers were literally finding out of spec ways of modifying the floppies to prevent copying and again, if your drive struggled to read it then that's your problem.

I agree about monetisation, it's rampant and not in a good way. But I do actually think the large amount of choice counteracts that - I hate monetisation in Destiny for instance....but there are several other looter shooters to pick from so it doesn't bother me that much.

>>mobile gaming is adware that popularized microtransations

And that one has never been good. Even at the advent of mobile gaming it was already like this, from the very start.

>>hype-driven marketing tactics pushing pre-sales

This absolutely existed 20 years ago already. Hype trains and preorders are not new by any means.

>>And you can basically count good AAA studios on one hand.

I think that's generalising too much - there are very good games coming out of AAA studios as well as incredibly poor ones. Ubisoft for example has something like 40k employees, some of their studios produce absolute gems and some produce....not that. It's not so simple as saying AAA is bad and Indies are not(the amount of that "shovelware" coming out of indies is absolutely staggering, people complaining that their 6728th farming sim doesn't get any sales on steam....like.....there's just too much of everything).
Postgres is not just a relational db. It's a way of life.

JSONB, HSTORE, LTREE, Full Text Search, Logical Replication, Range Types, BRIN Indexes, GIN Indexes, GiST Indexes, SP-GiST Indexes, Table Inheritance, Foreign Data Wrappers, XML Support, UUID-OSSP, pg_trgm, Cube, Earthdistance, pg_prolog, pg_partman, pgvector, TimescaleDB, PostGIS, Citus, pg_cron, BDR (Bi-Directional Replication), PL/Python, PL/Java, PL/V8, pg_stat_statements, pg_prewarm, pg_hint_plan, pg_repack, pgAudit, pgRouting, Multicorn (FDW), HypoPG, pg_squeeze, pglogical, Postgres-XL, Wal2json
> It turns out people who take amphetamines really like amphetamines.

More than that. They also like to post about how much they like amphetamines on the internet. Tirelessly.

The part of this article that mentioned that was the most insightful I thought.
very good - wish it supported other platforms.
my understanding is that any Debian/RPM-based Linux running sshd would become vulnerable in a year or two. The best equivalent of this exploit is the One Ring.

So the really strange thing is why they put so little effort into making this undetectable. All they needed was to make it use less time to check each login attempt.
Everything else were acquisitions and all the self made products were a failure.
I was turned off by the subscription model. No way I would use this frequently enough to pay for a subscription. And I have a 9 yo who plays with legos every day.
Can we please stop preaching this never coming assistant era. The tech exists to bark commands at computer for decades, it's not happening. People want to control their devices themselves, not making the bigger/louder mental juggling of forming commands all the time.