skysight-inc/HackerNews huggingface dataset:
Would ssh servers with port knocking set up be safe from this backdoor?

I'm not sure I got it correctly, but seems the RCE can only be performed after connecting to the ssh server, but if the port is hidden behind a reasonable sequence of tcp/udp knocks, then it won't happen?

I've been using port knocking on ssh servers, and it definitely does not replace proper ssh configuration, but so far seems like a cheap extra layer of defense that might either prevent or give extra time to respond when these ssh vulnerabilities appear.
The illusion of being stuck
There are some interesting plots (including future predictions) from the IERS Bulletin A data here showing the insertion of leap seconds over time to balance against changes in the Earth's length of day: https://datacenter.iers.org/singlePlot.php?plotname=Bulletin...

It isn't obvious yet to me that there will certainly be a negative leap second (or even a positive one, for that matter) needed in the upcoming years, but predictions farther into the future here are difficult. However, the changes in the length of day that have kept UT1-UTC so close to zero the past several years are very interesting, and as a result we haven't needed a leap second since the end of 2016!

And since the BIPM decided a few years ago to abandon leap seconds by 2035, if this somehow manages to hold for several more years, it's possible that we may not even see a leap second insertion (or deletion) again.
Oooh, maybe you know:

What camera / film might have been used for those sepia pictures I keep finding in my family’s old stuff?

Btw: That description with the black blacks was bang-on. Also the smoking, and the haircuts.
Thank you! If it has a github link I will star it now to remem. :)

edit: I clicked starred your github but not sure if it's directly related to this site. It ok, it will help me remem it. :)
Good notes on both fronts, so thanks!

We have been on the fence about this (and still are!). One option is to add this kind of UI in a "tutor" mode that starts on, and can be opt-out at some point. Not sold on it yet, but mulling it over.
Giphy is sharing your IP address and private data to 816 partners
>They also used a sock puppet with a seemingly German name (Hans Jansen). However "Hans" has not been a popular baby name in German speaking countries for many decades. You'd expect any "Hans" to be over 70 or 80 by now. Unless they are American, like Hans Niemann.

Jansen is a Danish/Norwegian surname and Hans is still fairly popular in Denmark.

https://www.dst.dk/en/Statistik/emner/borgere/navne/navne-i-...
> i'm not particularly convinced by anything there

That's fine; I'm not trying to change your mind because you've clearly already decided you know enough facts and aren't going to listen to any new ones. I respond in discussions like this to educate undecided readers.

> if i'm being completely honest, i'm not entirely sure what's even meant by the suggestion that ADD/ADHD is 'caused by the structure of the brain.'

> sentience is 'caused' by the 'structure of the brain.' and?

It's a direct refutation of your wrong claim "an ADD/ADHD diagnosis is not physiological", which you said a few posts back.

You know what the word "physiological" means, right? You said it, so it seems like you thought it was important enough to say, but now that it looks wrong you want to say it's not important?
"Emancipation of women and free education for girls worldwide. Raising the standard of living in poor countries."

Yup, let's push our ideology on other countries because the west is white is right.

We won't go into the impact certain gender equivalent movements have had on the world.
This is another interesting link about the issue:

https://lcamtuf.substack.com/p/technologist-vs-spy-the-xz-ba...

It mentions something not being reported, the issue is with a Linux specific patch to OpenSSH. If the patch did not exist there would be no issue.

This is not an OpenSSH issue but a Linux issue.
They're shrinking globally. https://www.sciencealert.com/birth-rates-are-plummeting-in-m...

That said, the world will probably be black by 2200. Makes sense.
We source the definitions from Wiktionary, but have a much higher bar for words to count as valid in the game. ST comes up often, as I agree it's one of the iffier words, but even Cambridge claims to to be so: https://dictionary.cambridge.org/dictionary/english/st
Thanks for the bug report. This should be fixed now!
I was shadow banned for some time when using Opera’s proxy once. Was quite annoying since I didn’t know for awhile, but when I contacted them they removed the ban immediately.
Can’t wait…buying on release day…upgrading from 2019 iPad Pro
JIRA. The first true Eldritch horror to reveal itself in the modern age.
[[Citation needed]]
"If it's for non-commercial use."
This is very nice! Someone I know made one of these too a while back with a similar UI - https://gkpotter.com/projects/rgb/
> So far, the utility on existing codebases is less than zero.

I'm curious what definition of "Utility" you are going by here - at the most basic level of "smarter, more context-aware autocomplete", does it have zero or negative value to a developer? Would you disagree that even an experienced developer could save some amount of time, at the current state of the technology, even if only at the stages where you're just writing code you already have a pretty clear concept of in your head?
The same. Not necessarily a link, but more and longer quotes, rather than short quotes and interpretation of them.
> see a bunch of new video hosting sites

i doubt that.

The business of hosting video is not the hosting itself. It's the ad-driven revenue you can derive, which requires eyeballs first.

Youtube's eyeball count is through the roof compared to any new video hosting site. Content creators will not switch off youtube, unless their revenue from this new site is sufficient compared to what they could've gotten from youtube (or they mirror it - in which case, why would anyone go to this new site?).
Out of curiosity: did the name change because of issues with Blizzard?
I find that it’s fairly reliable unless there is a ton of money involved. A marvel movie with a giant budget that the studio needs to do ok? Probably gets a 10-20% curve. But a cryptic indie film? Generally pretty close. Basically usi
> Why would anyone out of the blue willingly make their personal area worse?

Because infrastructure has go somewhere.

The Netherlands has this issue: everyone resists any energy infrastructure in their area. Now there are many people who own new houses who can't move in because there's no electric power for them. Nuclear power is impossible because of NIMBY, so 85% of the energy is fossil fuel based.
Is Overleaf (online LaTeX editor) making $40M+ ARR and a unicorn?
Overleaf has 11m users, if we take an assumption that 2% of its users are paid users paying $200 / year then it translates to $40m+ ARR

this is likely to be conservative, and very easy to see the ARR being above $50m+ with double digit growth.

hence, Overleaf seems to be a GOAT startup. Highly profitable, likely valued $1bn+

what am i missing?
Thank God there's a BSD-licensed option. The notion that a business would pay to use software because the license requires it is just... appalling.
Wipe out America and another imperialists take it's place. That's not the answer. Hookey as it sounds living in harmony with nature, recycling, reusing and resource management are what's best.
The worst thing about VPN:s is the other users who get you blocked with them.
Not really. Just make your software AGPLv3. It's literally the most free license GNU and the FSF have ever come up with. It ensures your freedom so hard the corporations cannot tolerate it. Now you have leverage. If the corporations want it so bad, they can have it. They just gotta ask for permission to use it under different terms. Then they gotta pay for it.

https://www.gnu.org/philosophy/selling-exceptions.html

All you have to do is not MIT or BSD license the software. When you do that, you're essentially transferring your intellectual property to the corporations at zero cost. Can't think of a bigger wealth transfer in history. From well meaning individual programmers and straight to the billionaires.

The BSD style openness only makes sense in a world without intellectual property. Until the day copyright is abolished, it's either AGPLv3 or all rights reserved. Nothing else makes sense.
It was more frustrating than fun for me
I have to wonder what the creator has against Mike Boyd? "Nebula: filter out videos by creator... To get the code for a creator, go to their page... For example, Mike Boyd’s page..."

Filtering Nebula in general seems like a low-probability use-case?
Basic electronics, so I can build one of these and maybe extend it to three computers: https://github.com/jfedor2/screen-hopper/
I'd rather leave those rigid gender roles in the dump where they belong. My mom was the primary breadwinner in my house, and they're decades into a successful marriage with healthy & happy children.

Fitness, wealth, status, and power will always help you accomplish whatever goal you want. If what you're looking for is a deep, meaningful connection with another human, then I would advise you to interrogate the means you use and not just the end you're after.

It's good to work on your personal development. Not so good to put yourself in a box. If, god forbid, one day you get into a freak accident and can no longer work—you're going to get dropped like a hot potato if you've settled for someone who only sees you as a protector and provider.

If someone needs a parent they should see a therapist, not search out a glucose guardian.
> It mentions something not being reported

This has been reported and discussed from the start, even in the initial report. Also it's not a Linux specific patch or issue, rather a patch used by some Linux distros for tighter systemd integration.
The sepia pictures are probably that colour because of the toner that was used at the time when they were printed. The silver halides used in photographic paper weren't very stable and were still quite light sensitive. Sepia toner, as well as giving an artistic view, were used to convert the unstable halides to silver sulfide which lasted a hell of a lot longer (as you found out :)

So not film or camera specific really.
"FACADE" came the reply
I'm installing a mini-split in my basement right now and I'm also learning how to design replacement hubcaps for my rig.
> we need deurbanization not in the USA model of suburbs but in the "Riviera model" of the EU, meaning spread homes AND workspace intermixed, with a string push to the home office, meaning homes where most people work and live in the same place

I think you have something here. I'm not sure I agree with the "deurbanization" idea, and I'm not sure what this "Riviera" style would be, but I do note that some of what you're describing is also possible in urban environments, for example in Asian cities (or European cities a few generations back, the ancestral knowledge of which has been forgotten), where sole proprietors and family businesses operated in the way you describe. Moreover, it's possible in second and third tier American cities, where prices have not forced out ordinary people. Indeed, there are many semi-abandoned towns with good urban cores, ready to be revitalized, a la Strongtowns.

Individual ownership is entirely achievable in such places, but it does also hinge on a degree of coordination with others, because no one person can single-handedly bring a Main Street back to life and make it desirable again; a critical mass is required. It is this failure of individuals and small businesses to coordinate that makes them easy prey for the megacorps creating our dystopia.

Possibly a new mechanism for social organization in the vein of the joint stock corporation, HOA, traditional Chamber of Commerce, or even city government could solve the problem. Maybe that's what we need: Small-town mayors with the attitude of CEOs (let us not be led down the path of messiahs/fuhrers, however). Something requiring more active civic participation. (Perhaps the multiplication of university administrators can also be seen as symptomatic of students' abandonment of self-government. Is this because they are too diverse to form a democratic collective with a collective will? Or are the muscles just unexercised?) This requires more thought, or, better, more active experimentation.

I do see an objection to over-urbanization, which is that a too-large city becomes divorced from its agricultural surrounds, becomes food-insecure, dependent on outside sources of food -- at which point the giant agricorps enter. A more permaculture-type vision is appealing, but it doesn't seem compatible with cities over a certain size.

Smallish cities and largish towns, however, can be totally compatible with this style, and nearly all European cities fall into this category (they are all small).

Stepping back just a little, I do also think you're onto something with your emphasis on defining a future. That's why this kind of musing may have some thing value: Perhaps it helps in the imagining of such a future.

It must lead to action and experimentation, however, to really be valuable.
That page only defines it as an abbreviation (for saint, short ton, street, or stone).
I do not use or recommend security through obscurity.

Such things can always be automatically discovered.

https://github.com/eliemoutran/KnockIt

Any effort spent on setups like this is likely better spent removing the need for having ssh at all by moving to immutable appliance distros be they specialized like homeassistant or general purpose like TalosOS.
Primarily options trading and golf.

Multi-turn conversation and knowledge system implementation techniques on the side.
> I am really quite heavily involved in the tech sector, across a lot of domains. I don’t know a soul who runs a BSD variant.

Really? Wow. I know quite a few. Perhaps your experience isn't as broad as you think.

> How can I expose myself to this arena beyond making a BSD box…

You can't. Make a BSD box.

> which seems like a waste of time at the moment.

That is an exceptionally foolish comment, which others have pointed out, and you deserve it, I'm afraid.
If we are talking long running multithreaded processes, then libc malloc have issues that isn't even fragmentation. There are many workloads when it seems to forget to return whole empty pages and just accumulate allocated areas despite them being totally empty.
Oh! Yes, this is an interesting case. Towns actually slot into the battle as one-letter words, so this case FEN is long enough. It doesn't come up much, but it might deserve elaboration in an "advanced" tutorial since it's unexpected.
YouTube was one of the jewels of the internet. Now that Google is furiously yanking it's teats, YouTube has become just another "fuck you, pay me" ad infested hellscape. Video distribution is ripe for disruption.
ah here we go, you don't like it because it's a culture war thing
Yep, I suspect the "win by 2 letters" thing is a play-tested thing. Simpler would just be "the attacker needs one more letter". But I suspect +2 results in a more fun game, at the cost of being slightly harder to learn the game and reason out the results of each battle.

Aside: For instance, +1 is the defender's advantage in Risk, and I always loved the mechanics added by the Lord of the Rings version (and maybe other versions) where you could modify that advantage to anything from +0 (with a "leader" in the attacking army), to +3 (with a leader in a defending army on a tile with a "stronghold"). This is a bit different because it isn't dice rolls, but a similar idea.
I'm always surprised at how much developers and maintainers will willingly put up with. For example, if you visit the Matrix feed for the Asahi Linux project, you'll see hoards of trolls and time-wasters that are regularly engaged by Asahi team members who are giving them the benefit of the doubt, when they really should be removing those posts without comment or acknowledgement.

I believe this masochistic behaviour stems from a combination of both general optimism and dedication to a particular cause. The more that developers are passionate about what they are doing, the more they are willing to engage with the peanut gallery.
This is kind of a rant, but I think we heap a whole bunch of expectations on math progress in school, that are unrelated to math and create a burnout atmosphere. There's a culture of fear surrounding math. Most adults, even people who are in supposedly technical occupations, outwardly hate math. Most can proclaim that they set their math aside after it got them through school.

Yet it's also chosen as an arbitrary measure for ranking children and gating their academic and career choices. Kids are "ahead" or "behind" in math. They're tutored during the summer and sent to cram schools. They're tested at every grade level. Math determines access to many fields of study in college. School districts are ranked by math scores.

We have some vague sense that math is important for something. Maybe it fosters intelligence or diligence, both of which are valuable I suppose. But never math for its own sake.

Disclosure: College math major.
It’s not an issue in practice because, contrary to tracing GC, it doesn’t affect the other threads. So it doesn’t really count as pausing.
Many of the creators I follow upload first, or alongside nebula. I’ve been using it to try and reduce my YouTube watch time with great success.
How does one go about such a land purchase? Are there specialized brokers or websites?
I find most kids are required to read very little. If it wasn’t for AP courses I probably would have skated through high school only having to read 5-8 books. That’s absurd. Kids should have to read a book at least every month.
You're assuming some things there, which may or may not be true for this person.
Good discussion with good reasons, very much like the other design decisions that they made so far. I just believe that when it comes to the plug-in idea that their priorities are not the ones that will be important in the long run and that they vastly underestimate the importance as well as the effort of a practical and useable sandbox implementation.
> Maybe we need an option to make the compilers output a standard JSON or whatever...

While I like the idea, I fear this would go the same route as UserAgent strings, with everybody giving carefully crafted lies. The main issue is that bugs are only known in retrospect.

As an example, suppose Compiler A and Compiler B both implement Feature X. Therefore, they both produce JSON output indicating that they support Feature X. A year later, developers for Compiler A find and fix a bug in its implementation of Feature X. Now, how do we handle that case?

* Update the version for Feature X as by Compiler A? Now Compiler B is publishing the same version as the buggy Compiler A did, and would get marked as not having a usable implementation.

* Update the spec, forcing a version update for Feature X in both Compiler A and Compiler B? Now a bugfix in one compiler requires code updates in others.

* In the build system, override the JSON output from Compiler A, such that Feature X is marked as unavailable for the buggy versions? Now the JSON is no longer trustable, as it requires maintaining a list of exceptions.

* Try to trigger the bug that Compiler A just fixed, so that the build system can recognize the buggy versions, regardless of the JSON output? Now we're back to the starting point, with features determined based on attempted compilation.
Interesting. Jansen is pretty common in Germany aswell. How old would a typical Danish Hans be? From what I can see in [1], Hans hasn't been a popular baby name for decades in Denmark either.

Edit: Another country that seems to have retained popularity for "Hans" for a longer time than Germany is the Netherlands. According to [2], its popularity seems to have gone down significantly as well, with a further sharp dropoff in the 90s.

There are plenty of other names to choose from if you want to create a fake personality. It's curious they chose one that sticks out among the age cohorts you would expect participating on Github.

[1] https://www.dst.dk/en/Statistik/emner/borgere/navne/navne-ti...

[2] https://www.babynamen.nl/naam/hans/
IT;S DMCA NOT DCMA
Luckily should be pretty easy to modify to get the same result!
> Attacking my style of prose doesn't change the facts.

True! I agree with everything you've said in this second post.

However:

1. What you're describing as "the facts" has changed pretty significantly between your first and second posts. As it turns out, being more careful about how you communicate seems to make you more careful about actually stating the facts instead of your opinions.

2. Even if your first post were all facts (which it was not), I would prefer that the facts be presented persuasively so that people believe the facts--making the facts sound like the crazed ramblings of a stoned person is counterproductive to spreading facts.
Web App for Finding 'Useless' Website
Yeah? Well, you know, that's just like, uh, your opinion, man.
- how to build a fence and trying to wrap my head around convolutions and learn some stats in the process (theres a pretty good 3b1b intro on it but where to go next to actually learn it).
The state-of-the-art in refcounting[1] greatly improves the barrier situation over a naïve implementation: no read barrier, and the write barrier only uses atomics when mutating an (apparently) unmodified field in an old generation object.

[1] https://dl.acm.org/doi/pdf/10.1145/3519939.3523440
On the other hand, accepting significant amounts of money causes overhead (accounting, taxation). Plus it reinforces the psychological obligation and it's not fun anymore. Thus many maintainers avoid it.
You're probably reading this whole thread, but in case you didn't see an idea I had elsewhere: I like the "tutor mode" idea, and think it would be nice for it to highlight all the currently-valid words (maybe toggle-able).
Ash is mostly carbon.
> At that scale it wouldn’t even be obvious the forest was being harvested.

Humans' hand is always visible: the stumps of cut-down trees, and the (mostly, if not complete) absence of fallen trees. Besides the odd trail used for vehicles. And trash, wood chips, markings on trees, etc. Such signs remain visible for centuries.

Natural forests are littered with fallen trees, which serve as food for sapplings that take their place (nurse logs). And trees don't fall with a clean cut: they are ripped from the ground in a storm, split by a lightning strike, or they die, rot & come down in pieces.

Doesn't take an expert to see what's what.
Precision frequency synthesizers.

Also, how to deal with the annual crop of leaves on a few acres of woods.
Why not just have zero wifi credentials?
Yes (this sentence was sponsored by NordVPN), that.
Anyone have a good way of backing up their HN writings?
I hadn't thought of doing this! But yeah, I agree with what you concluded previously - passing turn is too powerful, I think.
Seeing an Asian (any part of Asia) name wouldn’t give me any pause in the slightest. I don’t want to start anything here, but aren’t they disproportionately represented in the American software industry as compared to their percentage of the population?

What would raise my hackles would be someone with a name that codes western who had grammatical idiosyncrasies common to ESL Asians.
Ah, 2am reading comprehension on my part. Yes, if we ever remove rather than add to the dictionary in the future I might look to axe it.
The market is limited. Very few people use LaTeX.
Wouldn't it be better to expose 128-bit vector registers for this purpose? Like how the aarch64 module exposes int16x8_t. That seems much better than relying on a generic 128 bit type, because the use-case is clearly specified.
I've had that happen with IP:s handed out to ADSL and 4G as well.

Maybe it's more common with VPN:s, though it's not with the provider I use.
_BitInt(128) is a C(23) type and has all of the same problems plus a few others.
It was, IMO, a great class.