skysight-inc/HackerNews huggingface dataset:
I believe my employer is preparing to replace many or most of their human customer service representatives with LLMs or some form of AI. They haven't said this is their plan but based on several things like the new software and tools they've recently switched to, the fact that all customer services reps have been fully remote since the start of COVID and the volume of calls they can't currently handle in various geographies. I'm just speculating but this is my expectation, and the transition may take many years.
Using the built-in browser OCR is usually much better but it is still behind an experimental API.
Why does it have to be russian? Could be any country, even USA, China. I don't see why this sort of attack is limited to Russia.
For now, the researcher using our tool needs to check.
[dupe]
https://news.ycombinator.com/item?id=39789420
XZ backdoor killswitch
There appears to be a string encoded in the binary payload:

https://gist.github.com/q3k/af3d93b6a1f399de28fe194add452d01...

Which functions as a killswitch:

https://piaille.fr/@zeno/112185928685603910

Thus, one workaround for affected systems might be to add this to `/etc/environment`:

```

echo "yolAbejyiejuvnup=Evjtgvsh5okmkAvj" | sudo tee -a /etc/environment

```

+ restart ssh and systemd
It is useful for repetitive tasks usually
He had unfettered access to xz’s git?
This is not true. Japan and South Korea both experienced the majority of their growth as democracies. Eastern Europe only took off after the fall of the USSR. Chile experienced most of its growth after Pinochet. India is the largest Democracy on earth and it is growing at a very fast clip.

That being said, there simply aren’t very many countries and even less ones that made the successful leap to rich world status regardless of the political regime. There’s a huge small sample problem here. And then of course there’s also a huge endogeneity problem. The literature in general has found a weak positive association between democratization and growth. And that’s about the most we can say. Stop worrying about the data not being on your side; it isn’t on anyone’s side.
I've used irfanview for more than 15 years now. Mostly for looking at pictures. It's plenty fast.

Doesn't work super well with multimonitor and should just ignore non-image files though imho
Xz is an open–source compression program, as well as a library that can be used to help you write your own program that deals with compressed data. It is used by a fairly large number of other programs, one of which is OpenSSH. OpenSSH is an open–source program that allows remote users to access a computer, usually a server, provided they have the correct credentials (such as a valid password or encryption key).

Xx has a reasonably venerable history, and has passed from maintaner to maintainer several times in the past. A few years ago, a new maintainer stepped in to take the job. A few weeks ago he released a new version of the Xz library. This new version crashed a number of times when it was incorporated into Debian (an open–source Linux distribution of similar venerability). These crashes were investigated, and a back door was discovered.

The new version of Xz detects that it has been compiled in to OpenSSH and adds it's own code to the part of the program that checks the credentials of the user who is logging in. When an incoming connection is encrypted, the back door code checks the encrypted data for a message signed by the back–door’s author. If one is discovered, the the message is executed immediately, instead of logging anyone in. The allows anyone with the right key to secretly execute arbitrary instructions on the targeted computer, usually with full root access. Obviously that's not something the Debian or OpenSSH developers want included in their programs.
They have monitoring for their infrastructure, right? Add 50 lines of code that connects to all public domains on ipv4 and ipv6 and alerts if the cert expires in under 19 days. Set automatic renewal to happen 20 days out. Done.
I wrote this code years ago, after missing a couple ssl renewals in the early days of our small company. Haven’t had an ssl-related outage since.

Edit: this is the only necessary fix, no need for calendar invites:

> We also plan to update our prober infrastructure to check IPv4 and IPv6 endpoints separately.
Sheesh, what the heck was I thinking. Yeah, 2007.

I should have been a little more precise. I mean a wholly Boeing designed product, from the 21st century. The MAX is still a 737 in its heart, and that design goes back a ways.
agreed. but it does not mean i couldn't be. as per the terms, the content of a CLA could be anything. and that's my point
Does your company care if you're "available"? I'm supposed to keep my slack dot green during working hours.

I think the awesomeness of remote work really depends on the company culture. If you're in a meeting heavy environment, it may be pure hell for anyone trying to do technical work. If someone schedules 3 meetings with a half hour or more in between, the whole day might be shot.
Of course I post on a throwaway. HN is full of idiots who downvote cos it goes against what they believe in.

Fact is Facebook has been advertising using user data on messenger and WhatsApp. Some believe it’s not possible and some theorise that they analysis the message on the device and send metadata over.

But it doesn’t change the fact Facebook is in control of the whole pipeline.
House of cards experiences strong wind.
I find everything is more than just file search. It often works super well as a stand alone file manager.
I log on later... like often to the point of being late. Some days, I log in and go back to sleep for an hour or so. I'm not built for a "career."

I'm a night-owl kind of person, and I just can't make myself function any differently. Remote work greatly benefits me with a relaxed time schedule, since no matter when I log on/go to work, my brain doesn't start working until about 1:00pm/13:00.
I might think to suggest that unchecked capitalist exploitation of our natural world has an awful lot to do with the inequities you brought into the discussion. And, if you grant me that this is possibly true (even if unconvincing or unprovable), surely you would agree that someone who believes such a thing would be prosocial and certainly not racist to scoff at the notion that somehow ever-more-unchecked-exploitation is the path to absolution.
The most reliable indicator of a shortage is abandonment of a price-based mechanism in favour of something else, like a lottery or needs-based selection. If price is able to select the buyer, then you can't possibly have a shortage.
The terminology is a bit of a mess, but usually a PLA is highly structured with an AND plane and an OR plane, so it implements sum-of-products logic. A gate array is more general, with arbitrary connections.
The name is definitely clever. I do feel like terminology in our field might need to change a bit at some point as to make communication easier with other fields.
What exactly is a CLA going to do to a CCP operative (as appears to be the case with xz)? Do you think the party is going to extradite one of their state sponsored hacking groups because they got caught trying to implement a backdoor?

Or do you think they don’t have the resources to fake an identity?
Perhaps demographics of fast food hires versus other restaurants or industries? Perhaps push-back from restaurants that rely on tips?
compiler would perhaps "see" it ?
Expose port 443 (yes, for https).
i know there are workarounds, just saying it is not a drop-in.

I decided to run an app in docker rootless in my personal server and there are a whole bunch of problems related to that. A lot of images expect to be run as "root all the way down"
I'll bite, I'll prob get a bunch wrong but you'll learn from the people who correct me...

xz is a very commonly used compression tool (think zipped files etc.) so it's used everywhere, someone(s?) managed to slowly work their way into the project and inserted a backdoor.

SSH is the main way to connect from your terminal to server, the most common way to connect is not via username/password but public/private key (google RSA). what this backdoor does is add a step to the SSH login process. instead of 1) check whether correct key was sent 2) if yes give access, if no say 'incorrect'. it adds one step 1.5) if key is {special evil key} then run all commands that owner of the special evil key says to run. Since the SSH service (program, whatever) runs as root (that's like admin on linux) the attacker with the special key can do basically anything.

Worth noting, the bug technically has nothing to do with the compression program, it was sneaked in using it
What would you change about your coding because of deploying in a container? What do you tell your junior & senior engineers to do differently?

I call bull frelling shit. It's not an abstraction. It's a deployment pattern. It doesn't affect how or what we code.

Endless shitty pointless bullshit grousing, over nothing. It doesn't actually matter. It's just hip, you get to feel good, by pretending you are dunking on sheeples. Frivolous counter-cultural motions that people use to make themselves feel advanced & intelligent. But actually, being free of this pattern doesn't really buy you anything new or different. The same code & the same approaches are viable with our without. It just feels good to be shitty to the mainstream.

If there were abstractions maybe there would be some justification for the slippery slope "oh no!" panic. And K8s is definitely some kind of abstraction. But the sloppy slippery slope "oh no abstractions" shit still pulls no weight for me, fails to acknowledge that sometimes abstraction can & is useful, allows good things.
Can legal action be taken against the author if it's found he maliciously added the backdoor?
Definitely with you on the ray/path tracer :)
The Amiga port got significant improvements, including many not listed in the release notes.

Xorg works much better now, first boot is significantly faster, and tools used for writing the installer image into disk can safely work with partitions extending above 4GB or over 4GB size.
I think for a lot of people “going out” when it’s to the office isn’t exactly a good thing. Like being at home isn’t somehow less pleasant than that. Neither’s “going out”.

And depending on your job you can go out to actual normal non-forced social spaces while working “from home”, some of the time.
For those squinting, the "landlock" regular "c" is replaced with a Cyrillic U+0441.
Why don't you get to know the people working in AI/ML at your current employer, and ask them for advice?

Trust me, it's MUCH easier to network within your own company than when you are an unemployed outsider.
Currently it doesn't work, but yeah, it'll be really cool when we have tech like that! (It'll still only be able to detect known vulnerabilities, but we don't often invent new ones.)
case closed. you are right... could of course make the things a bit more difficult for someone not backed by a state sponsor. but if that's the case, you are right.
In either case, it would appear as added code, not different characters in the same code, so maybe about the same. If someone changed one character in an existing string though, I think it would be more likely caught visually by someone used to seeing accidental garbage show up
That's stretching the traditional definition. Usually CLAs are solely focused on addressing the copyright conditions and intellectual property origin of the contributed changes. Maybe just "contributor agreement" or "contributor contract" would describe that.
Jordbruksverket = Swedish Board of Agriculture
You only left out Bulk Renamed Utility
https://www.bulkrenameutility.co.uk
There are many like it but none finer.
Do you know why the flag?
Isn’t it a bit ironic with how much code everyone depends on that can freely be altered by some unknown party, while so much time goes into code reviews to verify internal changes at most companies.
"Raise the bar at the bottom and all wages will go up"

The people at the bottom might be making more, but they won't have spending power for very long because the cost of everything will go up. This cycle will just continue forever, unless the government starts fixing prices, which never leads to a good outcome.

When fast food workers wages are raised, we might see a few dollars more for meals. When you raise the wages in every other industry, it has a cascading effect. Just look at the number of jobs between products on the store shelf and how it gets there. Delivery, trucking, packing, shipping, etc. In this one example, it would raise prices 10X.
I work in Motorsports and a parts tracking database is an actual unsolved problem with each team building it's own bespoke solution. It's also kinda unique because your simulation tool is connected to the parts database and part of the tool has to work offline for running simulations in the plane.

I'm not really a database person so never really understood why off the shelf solutions aren't typically used here.

I'm guessing Williams probably just didn't have the budget to build one and didn't know any better so they used Excel.
Also: Why did Debian patch a service that runs as root and accepts connections from the internet to load unnecessary libraries?
This does not matter either. The attack came in by loading into systemd via liblzma. It put on a hook and then sits around waiting for sshd to load in so it can learn the symbols then proceeds to swap in the jumps.

sshd is a sitting duck. Bifurcating sshd into a multimodule scheme won't work because some part of it still has to be loaded by systemd.

This is a web of trust issue. In the .NET world where refection attacks happen to commercial software that features dynload assemblies, the only solution they could come up with is to sign all the things, then box up anything that doesn't have a signing mechanism and then sign that, even signing plain old zip files.

Some day we will all have to have keys, and to keep the anon people from leaving they can get an anon key, but anons with keys will never get on the chain where the big distros would ever trust their commits until someone who forked over their passport and photos got a trustable key to sign off on the commits, so that the distro builders can then greenlight pulling it in.

Then I guess to keep the anons hopeful that they are still in the SDLC somewhere their commits can go into the completely untrusted-unstable-crazytown release that no instutution in their right mind would ever lay down in production.
This makes sense. Latin America is incompatible with democracy and the reason for that is history; such a conclusion is so obvious it is a surprise that anyone would support the idea of democracy anywhere in the continent
m4 is somewhat obfuscated by default, that's a part of the problem IMO
Link the article? Sounds badly researched as Belarus and Russia are cold places with a lot more crime than hotter places in East and South East Asia.
In a democracy, over the long term, short term interests win out over long term interests. This is true of both the citizens and the politicians.

In a monarchy, long term interests win out over short term interests because they're dynastic and stay within a family. There is a natural incentive for long term thinking that comes with a monarchy.
I read it on mobile just fine.
>> Popular songs are simpler and more repetitive than they used to be

A-well-a everybody's heard about the bird!

Bird bird bird, b-bird's the word

A-well-a bird bird bird, bird is the word

A-well-a bird bird bird, well-a bird is the word

A-well-a bird bird bird, b-bird's the word

A-well-a bird bird bird, well-a bird is the word

A-well-a bird, bird, b-bird's the word

A-well-a bird bird bird, b-bird's the word

A-well-a bird bird bird, well-a bird is the word

A-well-a bird, bird, b-bird's the word

A-well-a don't you know, about the bird?

Well, everybody knows that the bird is the word!

A-well-a bird, bird, b-bird's the bird

A-well-a

A-well-a everybody's heard, about the bird!

Bird bird bird, b-bird's the word

A-well-a bird bird bird, b-bird's the word

A-well-a bird bird bird, b-bird's the word

A-well-a bird, bird, b-bird's the word

A-well-a bird bird bird, b-bird's the word

A-well-a bird bird bird, b-bird's the word

A-well-a bird bird bird, b-bird's the word

A-well-a bird bird bird, b-bird's the word

A-well-a don't you know, about the bird?

Well! Everybody's talking about the bird!

A-well-a bird, bird, b-bird's the bird

A-well-a bird!

Surfin' bird

Pa pa pa pa pa pa pa pa pa pa pa pa pa pa pa pa pa pa pa pa pa pa pa pa

Oom m-mow mow

Pa pa oom mow m-mow

Pa pa pa oom m-mow mow

Pa pa oom mow m-mow

Pa pa oom m-mow mow

Pa pa oom mow m-mow

Oom m-mow mow

Pa pa oom mow m-mow

Pa pa oom m-mow mow

Pa pa oom mow m-mow

Pa pa oom m-mow mow

Pa pa oom mow m-mow

Oom m-oom m-oom m-oom

M-oom m-mow mow

Pa pa oom mow m-mow

Pa pa oom m-oom m-oom m-oom

M-oom m-mow mow

Pa pa oom mow m-mow

Oom m-mow mow

Pa pa oom mow m-mow

Pa pa oom m-mow mow

Pa pa oom mow m-mow

Pa pa oom m-mow mow
Oom mow m-mow

Pa pa oom m-mow mow

Oom mow m-mow

Pa pa oom m-oom m-oom m-oom

M-oom m-mow mow

Oom m-oom m-oom m-oom

M-oom m-mow mow

Oom mow m-mow

Pa pa oom mow m-mow

Pa pa oom m-mow mow

Oom mow m-mow

Well-a don't you know, about the bird?

Well! Everybody knows that the bird is the word!

A-well-a bird, bird, b-bird's the bird

A-well-a oom m-mow mow

Pa pa oom mow m-mow

Ba pa oom m-mow mow

Oom mow m-mow

Pa pa oom m-mow mow

Oom mow m-mow

Pa pa oom m-mow mow
We are n(ever)* getting back together
Developers hate meetings, but they can be very beneficial. I can't tell you the amount of times I've had miscommunications over slack/teams that were resolved with a 10 or 15 minute meeting.
The possible intervention of Bukele in other countires affairs is concerning. For example, trying to create new political parties https://www.larepublica.net/noticia/un-bukele-en-costa-rica-... . Then you see that at the same time, El Salvador offers 0% tax to tech companies, Costa Rica defunds all computer science education in elementary/high school level and also defund an agency for bringing external investors... At some point you stop thinking that is was just a coincidence.
I think there's a good chance it's ChatGPT.
Difference is VA loans do not pay PMI.
Excel is a drug, and a lot of junkies have no interest in quitting. I actually work on software that has been used to manage the development of race cars. A couple sister departments use excel for everything my app does and are too set in the ways to consider anything else.
Popular music is not decided by the public anyways. The music that becomes popular is a sub-set of the music that is decided on by the overlords - the folks who decide what should play on the radio, on television, in movies, or on the internet. There are hidden weights and biases to the algorithms that select the songs put for display by your popular media service providers. It is not truly decided by the public, nor neutral in any way.
Copied from above. One does have : https://hackaday.io/project/185131-the-hack-computer-from-na...
Sadly the only way to even have a chance of fighting this is to insist on new contributors being vetted in person, and even that won’t be fool-proof.

It’s also not scalable and likely won’t ever happen, but it’s the only solution I can come up with.
> When you're taking a walk on a forest road, any car that comes your way could just run you over. Chances are the driver would never get caught. There is nothing you can do to protect yourself against it.

Sure you can. You can be more vigilant and careful when walking near traffic. So maybe don't have headphones on, and engage all your senses on the immediate threats around you. This won't guarantee that a car won't run you over, but it reduces the chances considerably to where you can possibly avoid it.

The same can be said about the xz situation. All the linters, CI checks and code reviews couldn't guarantee that this wouldn't happen, but they sure would lower the chances that it does. Having a defeatist attitude that nothing could be done to prevent it, and that therefore all these development practices are useless, is not helpful for when this happens again.

The major problem with the xz case was the fact it had 2 maintainers, one who was mostly absent, and the other who gradually gained control over the project and introduced the malicious code. No automated checks could've helped in this case, when there were no code reviews, and no oversight over what gets merged at all. But had there been some oversight and thorough review from at least one other developer, then the chances of this happening would be lower.

It's important to talk about probabilities here instead of absolute prevention, since it's possible that even in the strictest of environments, with many active contributors, malicious code could still theoretically be merged in. But without any of it, this approaches 100% (minus the probability of someone acting maliciously to begin with, having their account taken over, etc.).
Yes you have to be a veteran to qualify for VA loans.
Imagine a world where a single OSS maintainer can do the work of 100 of today’s engineers thanks to AI. In the world you describe, it seems likely that contributors would decrease as individual productivity increases.
How to Use Socket to Find Out If You Were Affected by the Backdoored Xz Package
So make a huge mess serving contemporary economics, damn the externalities, risk future of the species to serve some poor people now?

Sounds worse than sociopathy.

High minded platitudes not physical evidence is the preference?

May as well go back to religion.
That's a good one, thanks. It gives me `18:09 UT`, which is `12:09 CST`.

The Precision Eclipse calculator does seem to provide correct results in the US (e.g., 1:40 PM for Dallas TX). So, it must be a Mexico timezone calculation error.
I’m not sure this would be smaller scale? At least probably too early to tell?
The minimum wage in California is already $16, so this is only a 25% increase for this subset of an industry. This is equivalent to increasing the minimum wage to $9 in other states.
I don’t know how absolution figures into this or how providing an API for simulations of earths weather systems is some escalation of unchecked exploitation. In fact there was a HN headline article recently that extreme weather hurts the poorest nations because they lack the infrastructure to predict the weather well. Wouldn’t having such an API be of assistance? Is it possible that technology that’s three orders of magnitude more efficient (as they claim) be a boon to the poorest countries that are roughly three orders of magnitude less capable of affording advanced infrastructure like this? Or is grinding political ideology axes more important than actually making important things possible for the poorest countries?
Strings, Actually, Do Not Exist
Logged in HN users are able to mark things as "flagged". Once it reaches a certain score threshold, xx it's dead.
Crime is a numbers game. And certainly you can improve your odds by be being mindful of where and when you're exploring.

I wouldn't let fears of crime discourage anyone from visiting Latin America but compared to many other parts of the world you need to be much more aware of what's going on around you.
You should include git log --committer=Jia too as they committed what appears to be their other fake account's changes as well.

Also there are separate author times vs. commit times.
The Samaritan's [1] first attempt at a hostile takeover of the OpenAI Machine.

[1] https://personofinterest.fandom.com/wiki/Samaritan
In my code I have a bunch of routines optimized for different platforms, e.g. using x86 AESNI instructions. Not all compilers support them, and they don't even make sense when compiling for a different CPU architecture.

It's much simpler to say "enable this if we can compile it" rather than detecting the compiler and target platform and throwing a mess of conditional compilation into an autoconf script.