skysight-inc/HackerNews huggingface dataset:
You can have selective outrage. Insulin is clearly overpriced. Semaglutide, maybe not as much.
Xz.git: Fix Linux Landlock Feature Test in Autotools
Can you spot the intentional bug in this commit?
Yeah that’s what I am asking. Thanks
Which will make updates either expensive or impossible. You will be able to write books about exploitable bugs in the hardware, and those books will easily survive several editions.
It so cool to see it on the first page
No. From what I've read on the openwall and lkml mailing lists (so generally people who know a lot more about these things than I do), nobody accused Lasse Collins, the original maintainer, of being involved in this, at all, and there wasn't any notion of him becoming untrustworthy.
I was referring to home internet (fiber), not cellular service. Home internet does not offer a prepaid option.
Modafinil needs to be better represented.
I see at least 11 sensors in the top two photos of the article including 8 or 9 sensors on the front face of the robot and three sensors on the rear side mid body forward of the hind leg, which I assume is duplicated on the other side, so maybe 15 external sensors at least.

I also did photo journalism in college and these photos are from an AP News photographer. One of the things I learned in journalism class is to always try to get a person in your photo, as it helps humanize the story. So it may be an autonomous capable robot they showed in R/C mode for journalistic interest.
Pop music and literature both reached a peak in formulaic-ness just in time for the LLMs to codify it.

Maybe if they push it far enough and hard enough in that direction we'll get some cultural pushback / revival?
One bit of nuance here is that you cannot buy FDA approved non-human insulin in the U.S.

That’s not because of an action by the FDA, but just that the manufacturers stopped selling it between 1998 and 2006:

https://www.fda.gov/drugs/frequently-asked-questions-popular...

So your only option is to buy the modern day synthetic analogs - or illegally import the old stuff, which the FDA notes here it has the right to block, but may allow under exceptional circumstances.
The NSA demands that Intel and AMD provide backdoor ways to turn off the IME/PSP, which are basically a small OS running in a small processor inside your processor. So the precedent is that the government wants less embedded software in their hardware, at least for themselves.

If we relied on gadget vendors to maintain such software, I think we can just look at any IoT or router manufacturer to get an idea of just how often and for how long they will update the software. So that idea will probably backfire spectacularly if implemented.
This has been investigated and the conclusion is IMO clear: the dogpilling accounts were part of the operation. See the parts about Jigar Kumar in this link: https://boehs.org/node/everything-i-know-about-the-xz-backdo...
That is a fine line to walk.

Since a lot of people that say it is 'solvable', and we'll 'adapt', seem to also be the same people saying we don't need to do anything, or argue against 'solving' the problem. Actually trying to block solutions.

It goes like this, 'the problem is solvable', 'so we don't need to try and solve it'.

Basically arguing for kicking the can down the road.

'Surely someone will solve this, so I don't have to, and furthermore, I'd really appreciate not being bothered with this anymore.'
Based on the level of sophistication being alluded to, I'm personally inclined to assume this is a state actor, possible even some arm of the U.S. govt.
> No one wants a Linux antivirus

ClamAV has been around for a very long time at this point.

It's just not installed on servers, usually
So why did the preferences of the mainstream modern listener change?
Plausibly by having set-user-ID capability but not others an attacker might need.

But in the more common case it just doesn't: you have an sshd running on a dedicated port for the sole purpose of running some service or another under a specific sandboxed UID. That's basically the github business model, for example.
I downloaded the 120+ page PDF of the report a few days ago. Nowhere does it list any information narrowed down to tech sector jobs. (Unless it's disguised in such a way that obvious search terms don't find the relevant sections.) It's about the status of working women in all jobs, globally.

> It's hard to find a clear rule that works for everything.

It wouldn't help, because people who downvote and flag would ignore the details of the rule anyway. They would let some things slide, and be harsher on others.
Yes. But...

> GC only solves the application memory part,

Except it does not. "Solve" that is.

It helps, yes it does

But as I have learnt the hard way (silly way too, to be truthful) GC will not help unless you actually delete all references to the unused memory

Perhaps GC have developed magic moo cow properties in the twenty five years since I made that discovery, but I think the point remains

GC is very helpful, but it does not stop resource leaks
As far as I can tell, the check is to see if a certain program compiles, and if so, disable something. The dot makes it so that it always fails to compile and thus always disables that something.
> Apparently the backdoor reverts back to regular operation if the payload is malformed or the signature from the attacker's key doesn't verify.

Does this mean it's possible to send every ssh server on the internet a malformed payload to get it to disable the backdoor if it was vulnerable?
It's part of a test program used for feature detection (of a sandboxing functionality), and causes a syntax error. That in turn causes the test program to fail to compile, which makes the configure script assume that the sandboxing function is unavailable, and disables support for it.
Government have lot of money and time to spend. So having one more tool in box for that single time you need to access a target where this work is entirely reasonable investment. Would this if it weren't used have been noticed possibly in years? That gives quite a lot of room to find target for times when it is needed.

And you could have multiple projects doing this type of work in parallel.
Reminds me of these topology tricks

https://www.youtube.com/watch?v=6ebiyOtn7NA
You can’t blame people. Our ancestors probably went into a state of trance with much simpler “music”. The brains didn’t change all that much since then.
But that's a check for a Linux feature. So the more interesting question would be, what in the Linux world might be building xz-utils with cmake, I guess using ExternalProject_Add or something similar.
In which case the defense will claim, correctly, that this malware was never distributed. It was caught. "Attempted malware distribution" may not actually be a crime (but IANAL so I don't know).
Even though sshd must run as root (in the usual case), it doesn't need unfettered access to kernel memory, most of the filesystem, most other processes, etc. However, you could only really sandbox sshd-as-root. In order for sshd to do its job, it does need to be able to masquerade as arbitrary non-root users. That's still pretty bad but generally not "undetectably alter the operating system or firmware" bad.
You could refactor sshd so most network payload processing is delegated to sandboxed sub-processes. Then an RCE there has less capabilities to exploit directly. But, I think you would have to assume an RCE can cause the sub-process to produce wrong answers. So if the answers are authorization decisions, you can transitively turn those wrong answers into RCE in the normal login or remote command execution context.

But, the normal login or remote command execution is at least audited. And it might have other enforcement of which accounts or programs are permitted. A configuration disallowing root could not be bypassed by the sub-process.

You could also decide to run all user logins/commands under some more confined SE-Linux process context. Then, the actual user sessions would be sandboxed compared to the real local root user. Of course, going too far with this may interfere with the desired use cases for SSH.
Visual: https://knotte.com/pages/nordic-design-duvet-cover-hand-pock...
I agree, someone has to pay for the research.

Stories like this seem to pretty clearly represent the hazards of private funding for drug research. Publicly funded research and possibly publicly funded drug production could eliminate this issue.
They have monopsonies. The drug maker has a choice of either losing some operating profit or going along with the price they set. The free riding is in these countries not paying a price that pays their share of the development cost of the drug.
I use mcedit hundreds times more often than any other console text editor on Linux.

I can't shake off the fact that Norton Commander was the first PC software I learned as a primary school kid.
Government of the NIMBY, for the NIMBY, by the NIMBY
You know, I thought it wasn’t for a while there, but I’m not so sure right now. If it’s cool, maybe it’s kinda retro-cool, like “late 90s enterprise webapp” cool. Is that cool? Not sure.
You do not like fuel cells? Ammonia/methan/pure hydrogen do not have the fuel density like diesel, but it is still very managable. Possibly even better all in all im terms of weight, as you need less fuel.
You are referring to Operation Northwoods [0], a set of plans from the 1960s, all of which were rejected.

Operation Northwoods came about because Brig. Gen. Edward Lansdale, asked the CIA to come up with a list of pretexts that might be used to justify an invasion of Cuba. This request had a number of planners at the CIA enumerate possible false flags that could be used as a pretext. One of those plans was a terror attack against US citizens. Operation Northwoods was rejected and never implemented.

The US has plans for nearly everything, but there is a massive difference between a plan that some CIA analyst is pitching and something the US is likely or even able to do. The US had all sorts of plans for how to handle a pandemic, but then when one actually happened, the plans couldn't be implemented because the US didn't actually have the capabilities the plans called for.

> example, perhaps they were planning to blame the hack of a power plant or critical infrastructure on this exploit, then use the "evidence" that was leaked to prove it was China, and from there carry out an offensive operation against Chinese infrastructure.

Backdooring OpenSSH would in no way function as a pretext for attacks on Chinese infrastructure. No one outside the tech companies cares about this. The US also doesn't need to invent hacking pretexts, you could just point to one of many exposed Chinese hacking incidents.

[0] : https://en.wikipedia.org/wiki/Operation_Northwoods
Music Was Better in the Sixties, Man (2012) <https://www.discovermagazine.com/the-sciences/music-was-bett...>
Design choices for post-quantum TLS
>They will as a result probably avoid traveling to unfriendly jurisdictions without a diplomatic passport.

First of all, it's not like their individual identities would ever be known.

Second, they would already know that traveling to a hostile country is a great way to catch bullshit espionage charges, maybe end up tortured, and certainly be used as a political pawn.

Third, this is too sloppy to have originated from there anyways—however clever it was.
Meet three people who may see the world differently than you do
The article is about simplistic styles though. There are an enormous amount of "bad" songs that don't seem to die.
I’ve heard this yes, maybe a mix of cube world and another game. I never played either but Veloren is fun even when all you could do was run and paraglide around the world and explore, but they’ve long since added many story elements too.
T-shirts are the easiest thing to fold. The real nightmare is the wife's pile of clothes. Every piece of clothing is unique and different in shape and size. Some of them I wouldn't even know how to wear let alone fold
No, publicly traded companies are beholden to act in the interests of the shareholders which in practicality is fairly vague. All companies are sort of designed to turn a profit or try to as they generally need that to continue existing but there is no legal requirement that they need to create a profit or maximize it, publicly traded or not. Obviously, companies do try to maximize profit as it makes everyone involved money but they don't have to.
This all depends on your era of course. How many 12 bar blues songs are there I wonder, hundreds of thousands perhaps?
Do you have some scripts publicly available to reproduce your research?
Perhaps they could merge into systemd, so we can finally be done with it and get to systemd/Linux.
Thanks! Macroexpanded:

Running the "Reflections on Trusting Trust" Compiler - https://news.ycombinator.com/item?id=38020792 - Oct 2023 (67 comments)

(posted by rsc himself!)
I guess xzdec was supposed to sandbox itself where possible so they disabled the sandbox feature check in the build system so that future payload exploits passed to xzdec wouldn’t have to escape the sandbox in order to do anything useful?

Sneaky.
Yes - but that's still not automating the documentation ... it's only [potentially] automating presenting it

So ... back to my initial narrowing-down inquiry :)
So get a 3D printer, a SBC devkit, altium license and subscribe to some online courses and go build it. No excuse today. I think you want it enough to write a blog post, but that doesn't cut it. Is the idea everything? I don't think this even qualifies as an idea actually, you just want an expensive iPhone/Pad and an external monitor, and freedom from the fantasy that open source software is therefore automatically audited and more secure.
How would this be possible? This backdoor works because lzma is loaded into sshd (by a roundabout method involving systemd). I don't think gcc or clang links lzma.
These companies are not selling drugs at loss in these countries. And these countries are not forcing the sale of drugs in the first place. The companies choose to take some profit over none. That does not make smarter countries that do negotiation anyway free riders.
It seems like the backdoor creates the potential to "cause damage" but doesn't [provably?] cause damage per se?

The author of the backdoor doesn't themselves "[cause] the transmission of a program ...". Others do the transmission.

Seems weak, unless you know of some precedent case(s)?
If it’s illegal then it’s moot.
Ask HN: ChatGPT launched Sep 2022 18 months later, what AI do you use regularly?
How to make LLM able to pick the correct tool to complete a task? (discord bot)
Hey, im creating a discord bot with one command /assistant.

Basically it takes as input `text` parameter, and you can use it like:
- "What's the most active channel rn?"
- "Explain the joke by @userX"
- ...

Im using discord.js, how can I make the LLM pick the correct way to retrieve the information for completing the user's task? e.g., with "What's the most active channel?" the llm would have to select the discord.js method for retrieving all channels.

Any resources on this?
> "After all, He-Who-Must-Not-Be-Merged did great things - terrible, yes, but great."

I think the most ingenious part was picking the right project to infiltrate. Reading "Hans'" IFUNC pull request discussion is heart-wrenching in hindsight, but it really shows why this project was chosen.

I would love to know how many people where behind "Jia" and "Hans" analyzing and strategizing communication and code contributions. Some aspects, like those third tier personas faking pressure on mailing lists, seem a bit carelessly crafted, so I think it's still possible this was done by a sophisticated small team or even single individual. I presume a state actor would have people pumping out and maintaining fake personas all day for these kind of operations. I mean, would have kinda sucked, if someone thought: "Hm. It's a bit odd how rudely these three users are pushing. Who are they anyway? Oh, look they are all created at the same time. Suspicious. Why would anyone fake accounts to push so hard for this specifically? I need to investigate". Compared to the overall effort invested, that's careless, badly planned or underfunded.
I think a lot of drivers view speeding and extending yellow lights as a bit of a cat and mouse game. As Carlin once said “Cop didn’t see it? I didn’t do it.”

Red light and speed cameras give police too much advantage in this “game” so they seek to take their own advantage.
I remember learning this and thinking it was so cool. Then I realized how much effort it takes to lay a shirt so flat and straight on a flat surface in the first place, and I went back to my “grab the shoulders, shake the middle away from me, bring them together, tuck sleeves in while folding in half” way I’ve always done.

Half the work of shirt folding is getting the shirt to a known orientation anyway, I much prefer letting gravity do the work here.
That's exactly the more interesting discussion I meant. Who pays the doctor, nurse, pharmaceutical companies, how are wages and prices negotiated etc.

But I hope you agree that in all of these models, the doctor does in the end get paid, i.e. accepts payment? I never said that the patient should be the one paying them directly. But if nobody does, there will be no doctor.
Have used it since forever. Just used it today an hour ago. Usually to paste a windows screenshot and then do minor editing or cropping.

Now windows has gotten a lot better, with the [WIN][Shift][s] shortcut (so cropping no longer is necessary). But that still misses a feature to quickly draw an arrow.

Irfanview has that. Screenshot, crop, F12, put an arrow to point at something, copy, paste into Teams.

So fast...
So you would only "expose yourself", specially a quite low friction action of trying a new piece of software, if you know someone who already "wasted their time" on it? Do you use the same criteria with every piece of software? What's your point?
I broadly agree, but I think we can draw a parallel with the arms race of new exploit techniques versus exploit protection.

People still manage to write exploits today, but now you must find an ASLR leak, you must chain enough primitives to work around multiple layers of protection, it's generally a huge pain to write exploits compared to the 90s.

Today the dynamic detection that we have for Linux packages seems thin to non-existent, like the arms race has not even started yet. I think there is a bit of low-hanging fruit to make attacker lives harder (and some much higher-hanging fruit that would be a real headache).

Luckily there is an asymmetry in favor of the defenders (for once). If we create a scanner, we do not _have_ to publish every type of scan it knows how to do. Much like companies fighting spammers and fraud don't detail exactly how they catch bad actors. (Or, for another example, I know the Tor project has a similar asymmetry to detect bad relays. They collaborate on their relay scanner internally, but no one externally knows all the details.)
and then that fork becomes more performant or feature rich or secure or (etc), and it becomes preferred over the original code base, and all distributions switch to it, and we're back at square one.
I'm not sure they make the correct conclusion (ie that people necessarily prefer simpler music when facing options).

I think it's more that... to be popular, you need to fit the tastes of many people, and the best way to do that is by being generic, rather than specialized or niche. So pop music is essentially about finding the common denominators in tastes, and sticking to only those features. Obviously that's going to lead to music which is simpler, more repetitive, and therefore broadly appealing. And it's the music industry which selects for this, as it's the most profitable formula (and the reason for the trend of things getting simpler over time). But as individuals, I'm not sure that's what people necessarily prefer.
> beyond the (presumably failed) login attempt

There is some evidence it's scrubbing logs so we might not even have that.
Yes, and Silk Road was a darknet site.

Silk Road was pretty well known in mainstream culture, was a featured story in Wired, etc.. maybe that's what made it worth mentioning.

If this info is posted on some mostly unknown darknet site, maybe they just don't want to make it more popular.
> stuff with non standard processes like sourcehut

Of all the forges, Sourcehut arguably has the most standard processes - mailing lists for issues, and git-send-email for contributions. I especially love the latter, because it means I don't have to register and create a repo fork etc. just to contribute a patch.
> - current systemd versions already remove liblzma from their dependencies, the affected distros are behind on systemd updates though

The affected distros aren't behind on systemd updates, the change to systemd you describe has been merged but not yet released.
I think they added it in parts over the course of a year or two, with each part being plausibly innocent-looking: First some testing infrastructure, some test cases with binary test data to test compression, updates to the build scripts – and then some updates to those existing binary files to put the obfuscated payload in place, modifications to the build scripts to activate it, etc.
> possible even some arm of the U.S. govt.

Possible. But why mention U.S. specifically? Is it more likely than Russia, Iran, China, France ... ?
For FreeBSD, search for Netflix Open Connect appliance. Also, follow @cperciva

For OpenBSD, build a router+firewall for your home.

For FreeBSD jails networking here is a post for a two server infra
https://blog.uirig.com/freebsd-jails-network-setup
Not understanding how this medication makes this possible is part of the problem here.
You are looking at a makefile, not C. The C code is in a string that is being passed to a function called `check_c_source_compiles()`, and this dot makes that code not compile when it should have -- which sets a boolean incorrectly, which presumably makes the build do something it should not do.
IrfanView. Now, that’s a name I’ve not heard in a long time. Haven’t used that the last couple of decades. Interesting to see that it’s still around.
Novo Nordisk is based in Denmark and they did a lot of research. Of course, cherry picking the stuff Eli Lilly brought first makes it seem they are the ones driving the thing forward but it only makes sense in the wider contact and when compared with what other have done first as well.
Significant performance and correctness improvements to the kernel
Lecture by Casey Muratori: Apple M-Series GoFetch Attack [video]
I found this lecture absolutely fascinating. Casey is probably the best lecturer I've ever heard!

Video was posted on HN, but the original URL became invalid after he reuploaded.
And why would I invest the time to figure this all out when the only one being advantaged are others?
Ouch!

> Rust does slightly better than C++ by enforcing trivial moves, at the cost of making many useful programs impossible to write.

What "useful" programs fit a useful definition of "many"?

It makes self referential looped data structures hard to write (double linked lists, trees with pointers to parents).

No loss. Great improvement to have fewer of those

It makes arbitrary allocation hard. Enforces behaviors. Makes a programmer think very hard.

"useful programs impossible to write. " No it does not. It ,ages a lot of bad ideas hard to implement, makes nothing "impossible "
One silver lining about the pandemic is the cat is out of the bag how robust the economy is despite what MBA's, economists, and rentier billionaires would have you think. And political leaders are now well aware of the bill of goods they were sold by those knuckleheads.