skysight-inc/HackerNews huggingface dataset:
> David: This may be the craziest part about the whole TSMC founding story. I'm 99.9% sure, Ben, you do not know this. Do you know what the pre-money valuation was on TSMC?

> Ben: No, I couldn't find that anywhere.

> David: It was $0. Morris Chang got no equity. Zero.

> Ben: So 100% of the company was owned by the investors?

> David: Fifty percent by the government and the other 50% were owned by the investors. Morris got nothing.

> Ben: And just got to keep his salary.

> David: He was a government employee.

> Ben: Wow.

> David: There by the grace of the government.

> Ben: Oh my God.

> David: Isn't that unbelievable? This is so the opposite of Silicon Valley.
I wish more parents were like you!
Doesn't look like a real DDos attack to me with the traffic numbers (of course, No true Scotsman).

4TB/200mb = 5000.
Build Simple RealTime Knowledge Server with RAG, LLM, & Graph in Docker
You're missing the point entirely. It's not that this image or porn is bad (or not), but that an image from a soft-porn magazine is used in a professional setting when you're not explicitly wanting to go down that road. What others do on their own is fine. But this image gives porn-connotations to people just wanting to do their job.

It's equivalent to having a poster of a woman in the office bathroom. Have it in your own home, it's fine, but don't push it on others.
This approach could work for dynamic libraries, but a lot of modern ecosystems (Go, Rust, Swift) prefer to distribute packages as source code that gets compiled with the including executable or library.
I can learn to resist

anything but a flogged mare
The amount of data you can fit in the URL is upto 512MB in chrome if you use the hash part in the URL.
https://x.com/JLarky/status/1771603877676142666?s=20
And still you are so insecure that you have to brag about how "the most beautiful women" have their eyes on you. It's not radical change, I think professionals call it midlife crisis. ;)
But isn't that software you download and run in your own environment?

I'm mostly not following what is under a DDoS attack. Is it their web page mostly consisting of marketing material with static pages?
I can write better with an llm than on my own, because

1. I cite large chunks of context,

2. I spend money on LLMs that can retain larger contexts

3. I give it my rough drafts like it's my editor

4. I have it prepare alternative treatments, outlines, and beat sheets

5. I ask it to analyze and critique my drafts

6. I critique and revise its drafts

By the time I'm done, I've hit maybe 5 major drafts. The writing is dense, and the voice is mine

These are important skills, and if a writer has them, it does not matter if they work with an editor, coauthor, or an AI. They will get work done, and their writing will meet its objectives. The critical engagement and care - even if assisted by an AI - will always make a work worthwhile.
Yes, Arch Linux’s OpenSSH binary doesn’t even link to liblzma, which means your installation is not affected by this particular backdoor.

The authors of the `detect_sh` script didn’t have that scenario in mind, so the `ldd` invocation never finds a link and the script bails early without a message.
So it talks about smartphones but all the drawbacks seem caused by social media.

What is the problem with smartphones for (somewhat sensible) games, looking at family photos, and watching pre-downloaded fairy tales? (no YouTube with its toxic recommendations!)
Money is money, and if the cost of making a million dollars is $250K and incinerating a town's entire historical record, apparently that's a fine price for some people.

Throw this on the heap of systemic ethical transgressions of the advertising industry, along with list selling, poor targeting practices, ...
> The only real solution is to do very careful code reviews.

Are there any projects that are well resourced enough to do this consistently, including all dependencies?
Maybe it's a Western Australian, or Indonesian, or Thai...

GMT+8 covers a lot of places
It’s a kind of word which only makes sense as a negation to its antonym. Because if the antonym didn’t exist then it would just fade into the background as “normal”.
Project IDX by Google
No worries, I'm excited to use it when that happens!
There are plenty of cases where you can't just change the file layout. And the GPU filesystem is being implemented by someone else, so the choice is: migrate your data to another filesystem OR fix the data-in-files layout, even though the files may come from completely different source than your application, the layout may be a standard or other applications may depend on it, or you can't easily change it for another reason.
> even TV is better than smartphones.

Why? My intuition is just the opposite. TV is passive, smartphones are interactive.
Yeah, or writing a blog post. Start with that. And keep an open section open to get comments.

Or maybe try to write something on some related subreddit?
"If you can brag and demonstrate that their fleet of 10k machines can't touch a single service of yours and can't even make it pause then I'd say that sends pretty strong message to other potential bad actors"

It is also pretty good PR.
What are you on a about? You're arguing against a straw man I've seen no one mention in this debate.
It is very easy. Why do so many people torture themselves with complex setups? Masochism?
CoH was amazing. Too bad the current iteration is dogshit.
Well ... it wouldn't. It'd be a bodybuilder shot cropped to the head. The shot, as used, isn't objectification. The original would have been, but it isn't used - because, I would suggest, of the objectification issue.
You seem to fundamentally misunderstand the mindset of these attackers. This can just be about a challenge or a show of capabilities on the side of the attacker.

Telling them how big and strong you are will just trigger some of them to show you just how big and strong their botnet is. And there's always someone with a big enough botnet to bring you down.
Is there any news concerning the payload analysis? Just curious to see if it can be correlated with something I have in my sshd logs (e.g. login attempt with specific RSA keys).
Obligatory shot of a page professing to be about UX totally ruining the UX.

https://ibb.co/Mk34N7s

Suffice to say I didn’t bother reading the article.
The 1 ternary bit models only compress the weights. You still add and subtract using bfloat16 for better accuracy. Dedicated silicon is mostly a waste, because you are only processing two operations per parameter during inference. Loading the parameters from slow DDR, GDDR or HBM memory is the bottleneck in practice and the only solution is PIM. I was honestly disappointed by Nvidia's Blackwell since it is just barely competitive with GDDR PIM.
Is that true? Large companies producing software usually have bespoke infra, which barely anyone monitors. See: the Solarwinds hack. Similarly to the xz compromise they added the a Trojan to the binary artifacts by hijacking the build infrastructure. According to Wikipedia "around 18,000 government and private users downloaded compromised versions", it took almost a year for somebody to detect the trojan.

Thanks to the tiered updates of Linux distros, the backdoor was caught in testing releases, and not in stable versions. So only a very low percentage of people were impacted. Also the whole situation happened because distros used the tarball with a "closed source" generated script, instead of generating it themselves from the git repo. Again proving that it's easier to hide stuff in closed source software that nobody inspects.

Same with getting hired. Don't companies hire cheap contractors from Asia? There it would be easy to sneak in some crooked or even fake person to do some dirty work. Personally I was even emailed by a guy from China who asked me if I was willing to "borrow" him my identity so he could work in western companies, and he would share the money with me. Of course I didn't agree, but I'm not sure if everybody whose email he found on Github did.

https://en.wikipedia.org/wiki/2020_United_States_federal_gov...
Migrating to zstd instead of Lzip seems an odd decision. Presumably xz was chosen to begin with because of its high level of compression, migrating to zstd would make every single package considerably larger.

Lzip uses the same compression algorithm as xz, but is otherwise a simpler and better-designed format, without any of xz's bizarre countainer-inside-container design decisions.
What parts of this problem aren't solved by archive.org?
We could say something similar about other tools. Even something like OpenSSL had a severe security issue (Heartbleed) discovered on 2014 and which was introduced 2 years earlier by the maintainer himself through a Git commit which occurred, if I remember, on the middle of the night of 31.12.2011 or 01.01.2012 (which lead some people to speculate whether that was intentional since "everyone" is usually celebrating with his/her family at that time of the year)
Did you learn your lesson to stay off of the crypto? If not, then that's why you feel nothing. It's part of your continued denial that crypto is pure evil. What's it going to cost you to ditch it, do you think? Another ten grand? More? I'm curious
Here are several points to consider:

- Presuming "no right to swim in the sea" as a given, the point remains that "don't be an evil cuntbag" also isn't a law. If we had to pedantically write every single undesirable behaviour in law books, there wouldn't be enough paper in the world. That's why laws are sometimes broad, to cover arseholes like this, and I hope she finds something to make a good case

- Bears can feck right off, but to be fair, they have just _slightly_ more right to the forest than tampons and turds have to the sea, right?
> I'm not sure why I feel this way. I feel very strongly that people can reinvent themselves.

I'd turn it the other way around. These inspirational stories tend to be extremely biased towards young, no-career, highly-driven, high-hope types who had a hail Mary shot that they took and paid off in someway or another.

It also doesn't help that most of these success stories are self-promotion pieces that overblow the success angle even when it's a miserable easily avoidable failure.

In that sense, it's a breath of fresh air to see a success story that focuses on someone who went for a masters, followed by a PhD, followed by a long career in a growing sector climbing the corporate ladder up to the very top, followed by leading multiple companies, and finally creating the company that disrupts a market. We already have too many stories on random clueless individuals hitting the jackpot due to sheer luck in a once in a lifetime shot, and there is absolutely no value in life lessons that boil down to "do like me, and buy the winning lottery ticket."
I still find it distasteful that Chrome's autoplay policy was "we allowlist a 'fair' list of popular websites that happens to include all of our big domains", when the UX for that isn't meaningfully better than the way it works in Firefox. I can't imagine it actually had much of a positive impact on Google's metrics either, so it felt like a huge waste of effort + additional complexity for nothing.

I wonder if the Firefox team ever considered taking the same approach to make Youtube "just work". Clicking allow the first time and never thinking about it again is pretty easy.
Reported Supply Chain Compromise Affecting XZ Utils Data Compression Library
Even notion has a similar approach to sharding postgres but both of them could benefit from having shard IDs prefixed with YY/MM/DD(as needed) otherwise it's back to the shard navigator once they max out against org-ids for each shard's capacity
Aren't we supposed to be decades past "women has no sexual desire, sex are for men" era? I support the ban, it's kind of weird a cutout porn is the benchmark, but I just don't see how LGBT-era human modeling and anti-porn stancing go together. Hypocritically speaking, the notion that cis-male/bi-person/lesbian-women porn[0] as reference image makes women uncomfortable has to be wrong.

0: and this is very rough edged caricature, no reason gender has to be specified here or subject has to be ignored
I meant normal SMS.
South Korea hopes new speed train links will help boost birthrate
> have not installed caches

Drupal, in particular, is notorious for having multiple layers of cacheing out of the box. Of course, you can always add some extra caches...
A library for optimizing web performance metrics during code compilation
I am developing a library that advises developers on incorporating best practices in their frontend code to address performance issues and best practices for core web vital metrics,
Typically, after deploying the application, tools like SpeedCurve or in local environment by everytime running the lightouse tool can analyze performance and provide suggestions based on the results. However, my aim is to preemptively address issues during coding to streamline the optimization process and minimize the time spent on fixing issues post-deployment.

What to capture thoughts of you all
Thanks
> Telling them how big and strong you are will just trigger some of them to show you just how big and strong their botnet is.

And? Let them keep feeding more data to Cloudflare so they deflect them even easier next time around.

Maybe I do misunderstand their motivation. But you seem to think they can knock down anyone they want. To me that's observably false; even the record-setting DDoS attack through (or on?) Cloudflare that was something like 1.6Tb/s didn't seem to do much.

Let them flex. They provide us with valuable information for free. :)
There are also plenty of examples of folks coming from nothing as well. Ray Kroc [1] worked a variety of odd jobs, his final one was a door to door milkshake mixer salesman before discovering/founding McDonalds, at 52. Looking at the most successful, it seems like the greatest common denominator is simply having a very good/novel idea, and generally also a silver tongue.

[1] - https://en.wikipedia.org/wiki/Ray_Kroc
Instagram is developing 'Blend,' recommended Reels for you and a friend
Here’s one take: https://signalvnoise.com/svn3/the-majestic-monolith/
It wasnt directed at you as person, but as an idea. Not sure if you ever did abuse report, but they are mostly ignored. Thats the problem. Everyone just waves the hand like, it doesnt make capacity issues, we can ignore it. Sure, until its too late.

Maybe I am overly paranoid, but seems that old russian maxima is reasonable: Fight when they coming for cent, because when they will come to take dollar it will be too late.
We should be able to produce a tar and a proof that tar was produced from a specific source code.

Quote from the article:

That line is not in the upstream source of build-to-host, nor is build-to-host used by xz in git.

Zero Knowledge virtual machines, like cartesi.io, might help with this. Idea is to take the source, run a bunch of computational steps (compilation & archiving) and at the same time produce some kind of signature that certain steps were executed.

The verifiers can then easily check that the signature and indeed be convinced that the code was executed as it is claimed and source code wasn't tampered with.

The advantage of Zero-Knowledge technology in this case is that one doesn't need to repeat the computational steps themselves nor rely on a trusted party to do it for them (like automated build - that can also be compromised by the state actors). Just having the proof solves this trust problem mathematically: if you have the proof & the tar, you can quickly check source code that produced the tar wasn't modified.
This hack exploited a fairly unique quirk in the linux C ecosystem / culture. That packages are built from "tarballs" that are not exact copies of the git HEAD as they also contain generated scripts with arbitrary code.

It would not have happened in any modern language. It probably wouldn't have even happened in a Vistual Studio C-project for windows either.
OpenAI built a voice cloning tool
It's more or less what the current last comment on the Debian thread is wondering about

"Is xz-utils going to be maintained? Will we want to keep in the archive
an unmaintained low-level library - low-level as in, susceptible of
getting pulled as a dependency in lots of places - and rely on it for
components such as dpkg?"
It's hardly surprising given that parsing is generally considered to be a tricky problem. Plus, it's a 15 years old project that's widely used. 750 commits is nothing to sneer about. No wonder the original maintainer got burned out.
It feels like they didn't learn the root lesson - move your 200MB setup file to a subdomain. You shouldn't host large assets like this on the same domain as your marketing/app site even if there is a CDN fronting it because an attacker can simply add a random query string to bust through the CDN cache and cause the cache miss to hit your box. The subdomain should be hosted on a different box and fronted possibly with a different CDN provider so that any large scale attack doesn't affect your marketing/app site (either due to your CDN provider or upstream network provider temporarily black holing you).
Oh yes. I found Paint.Net and used it for many years as a quick photo editing solution. It's lightweight, reasonably fast and sophisticated enough for most daily tasks. However, I find I no longer install it on my new Windows boxes because of Photopea. Photopea is kind of a Photoshop Express clone and runs entirely in the browser. It's amazing how fast and easy photo editing software can be. WASM is really amazing stuff!

If you want a cross-platform photo editing tool, give it a try!
There are very many such devices - at least every Android phone (but I guess Apple has the same). I installed Google Family Link the other day. Whitelisted 7 or so apps with what I consider age-appropriate content. Everything else is disabled.
PgAdmin PostgreSQL Tools
DPROM is just a something I made up for example, what I meant was receiving marketing SMS without a number to block ex: instead of 124 sender have ABC which cannot be blocked.
Right, I was thinking of Figma in 2024 for some reason (they seem to have conquered the market, I'll just assume they're profitable with that pricing they have), the article talks about Figma in 2022, from what I gather. Should have read properly.
The last few times I used a read-only rootfs it was to build an appliance-like device which you plug in, do stuff and when its not needed can be unplugged. For this, there's no other solution.
Added some more color to the original message in an edit.
My first thought was artworks like those of Tim Noble and Sue Webster:
Literal piles of garbage in several cases, but also much more than that.

https://www.artworksforchange.org/portfolio/tim-noble-and-su...
I don’t know about other parts, but here in France SMS is a shitshow. I regularly fail to receive them even though I know I have good reception.

This happened the other day while I was on a conference call with perfect audio and video using my phone’s mobile data.

A few weeks back, had some shop which sends out an SMS to inform you the job’s done tell me this is usually hit and miss when I complained about not hearing from them.
I think it makes sense to use a commonly used format here, the maintenance aspects are very important as this incident has shown. And I don't think the tradeoffs between compressed size and speed are entirely obvious. Trading off slightly larger files for easier maintenance would seem like a defensible choice to me.
> Arch Linux played an important role in making this compression software trusted and depended upon.

because of the way arch distributes packages? then what you think about freebsd?
Yup an open world and quite smart enemies made me explore the same checkpoint dozens of times, to get the most perfect approach.
Wow I didn't know there is a website.

Chapter 7 on the "images of an alternative way of life" (publicity) really struck me. I've watched this many times, I'm not sure a written essay can convey the "way of seeing" with the same intensity.

It is fascinating to me because , it seems to me, the image generation we have with AI now even further accelerates the production of those "Alternative ways of life". And I think, the logical conclusion is self destruction - I don't see how it can accelerate further. There's gotta be a point where we will come to our senses and value the immediacy of life.
> an attacker can simply add a random query string to bust through the CDN cache

You can configure the cache so that they can't do it:
https://developers.cloudflare.com/cache/troubleshooting/cach...

Without knowing their specific configuration, we don't have enough info to complain about that.

Also the separate domain doesn't really change much with CF in front. It could be nice for a few reasons, but it's not really bad. If you have a reasonable CDN already, there's really not much point getting a different one.
I was excited at first because UI libraries for react is a cool thing but saw the screenshot and did not like it at all myself. It just doesn't look pleasant to the eye IMO.

Borders are too round, labels are too close to the left side and also too close to the elements, font is too small, the color choice is weird.

Again, not some kind of design guru but something like this is definitely not something I would ever use just based on looking at the screenshot.
How do I safely read them from the remote box, assuming we really expect the box to get compromised?

If the box is compromised and I RDP, I can get mashed by an RDP exploit. If I download the image or pdf, I can get mashed with an image or PDF exploit.

This is why I never trusted the Qubes image/PDF disarm workflow
People has broken CI/CD so we do meme.
Not sure if 6M/m is a lot. Looks like not that much.
A very wise friend of mine once said, "to discover is to overestimate".
>In most applications you can work around this with redundancies and diverse technologies

Are you proposing that Mazda should put two engines in their cars? Or am I misreading this?

>hard earned decades of learning and be pressing advantages. Not every novel and viable solution ends up being an enhancement.

That's precisely what Mazda is doing. They poured decades of R&D into the rotary engine, and are leveraging that research to their advantage. Their engine's diminutive size means they can provide more interior space in a compact vehicle, which is one of the key benefits of an EV that you can't get with a conventional hybrid. There are innate material advantages to the rotary in this application, it's not just hand-waving.

There's nothing overly novel about series hybrids, either. Chevy proved they can deliver EV driving dynamics and efficiency with ICE convenience, even at a larger scale than Mazda appears to be targeting.

This entire comment perplexes me. I can't tell if you like what Mazda's doing, or if you dislike it.
Those numbers in the screenshot from Cloudflare represents requests to Cloudflare, not requests to the origin. It includes cache hits.
As an aside, I was intrigued by your use of quotes around "real life". I think we've collectively gone so far down the internet rabbit hole that real life, ie. not on the internet, is seen as the anomaly or unreal. Not the other way around.
True. In 2019, at the prompting of a film crew making a documentary about how damaging it was for her image to be in wide circulation, and who presumably paid for her time, Lena asked for her picture to be taken out of circulation.

As recently as earlier that year, her views were much closer to my own [0]:

>When I asked [Lena] if she had heard anything about the recent controversy around her image, she seemed alarmed at the thought that she could have a part in hurting or discouraging young women. I sent her some articles about the Lenna and later gave her a call to see what she made of them. The photo, she said, doesn’t show very much—just down to her shoulders—so it was hard for her to see what the big deal was.

[0]: https://www.wired.com/story/finding-lena-the-patron-saint-of...