skysight-inc/HackerNews huggingface dataset:
Your prof was correct. We need to cut down existing large trees, put them into long term use where they can be used for 100+ years and plant new trees in their place. It is the simplest and very natural way to capture carbon.

Fully grown trees are mostly carbon neutral, growing trees on other hand are capturing carbon. Perhaps we can cut down large trees, coat them with very durable recycled plastic and simply store them on coastal line.

Canada and USA can heavily subsidize logging industry where

1. They have 100 year plan to plant and cut trees.

2. Wood gets exported to poorer countries where deforestation is a problem.
It violated exactly zero of those policies.
Personally, I doubt that. I would assume that GitHub just banned all accounts that were directly associated with the project as a precaution.
Somewhat relatedly, if you use elasticised fitted sheets, you may not be aware (I wasn’t for the first 25 years of my life) there is a simple trick to being able to fold them neatly when not in use.

Essentially you fold it twice so that all four corners are “on top” of each other, then you tuck all the elasticised corners into each other.

You should now have it looking quite neat with one corner being a little cut off, but still otherwise neat, see step 4 here: https://images.app.goo.gl/yfg4BnqxjuB2ztwv6

You can then fold it over in what ever way you want to make it rectangular.
I find it so insane that people think the major VPN providers aren't all completely compromised one way or the other. As if you're really going to be able to just pass your traffic through such a business and they're going to actually keep no logs, and not have secret deals made with intelligence agencies, and aren't unknowingly completely insided/compromised by intelligence agencies. As if you can just push your traffic through a major VPN and intelligence agencies would just go "well shucks, oh man, they sure got us, we'll never know who it was, foiled again".
This is the latest in a particular thread in Earth science research.

Most prominently reminds me of the EU’s Destination Earth

https://www.ecmwf.int/en/about/what-we-do/environmental-serv...
- another digital twin of Earth climate

NASA has another project https://esto.nasa.gov/earth-system-digital-twin/
> Advice for founders afraid of repercussions if startup fails?

Aim to fail fast, if it doesn't fail at all... great. If it fails, fail fast so you can waste less time getting started on something new.
With sufficient investment in this it is pretty easy to grow a large forest. May not be redwood forest and may not be tree whose bark is wide enough to drive a car through, but you can grow pretty large trees in < 30 years which can capture tonnes and tonnes of carbon every year.

Suburban housing boom, building more homes is one good way to put that into long term storage while reducing cost of housing and improving our carbon footprint as suburban homes can last for a century.

We can also genetically modify trees to grow faster and bigger.
Probably, but let’s leave the super nice movie trees
That might have been true in the past, but nowadays at least macOS/Android/iOS can enforce several restrictions on the apps you install, like prevent them from changing OS settings/files, limit access to only specified/opt-in directories, limit the amount of background activity, etc.

I don't know about Windows or Linux though.
Given how all participants in the discussion were very focused on transferring ownership to the attacker I'd treat everyone in the entire e-mail thread with suspicion. I would not be surprised if Dennis Ens, the one who started the thread in the first place, was also a sock puppet of Jia Tan.
Tired maintainers have no way to distinguish one from the other, that's the problem.

Even if we say "no payment, no customer," it won't prevent determined attackers from paying significant amounts of laundered money in order to be treated as customers.
The difference is that people* know and accept that CloudFlare does this. They advertise it as a feature.

*most willing customers of CloudFlare.
It isn't that important because there is "deep state" (entrenched bureaucracy), but what were trumps first actions? To install kiss the ring loyalists into as many positions of power as possible and bleed the diplomatic corps out. There was a mass exodus of the "deep state" you are now claiming is what is actually important.

His first presidency was a resounding success for him. He found that he only has a few hurdles left to successfully become a dictator. He neutralized the press with the gish gallop and "lügenpresse"[1], he neutralized his party with the big lie[2], he neutralized the supreme court by installing loyalists and letting them take bribes, he neutralized congress through gridlock. The only real hurdle trump has left is the joint chiefs of staff and you can guarantee his first action as president will be to clean house of people who swore an oath to the constitution and replace them with people willing to ring kiss.

If he is installed we get either a military "coup" to protect the constitution from a domestic enemy or the constitution becomes just a piece of paper in exactly the same way the bible is just a book, venerated but not understood.

[1] https://en.wikipedia.org/wiki/Lying_press

[2] https://en.wikipedia.org/wiki/Big_lie
I always change the sheets in our house because my partner absolutely hates doing it. I recently realised this is because she has dramatically less upper-body strength than me, the "bit of shaking" is pretty exhausting for her with our heavy winter duvet. So this technique could be really useful for people with her build!
That was painful. Glad the alignment is fixed now.
Didn't Jia Tan add a single '.' in cmake script to disable the landlock?
> they are more important than all the programmers in Bangalore.

What do you mean by this?
The destruction of 'Cadillac Heights' in Robocop 3 was a part of downtown Atlanta scheduled to be razed to make way for Centennial Olympic Park. Worked out good for both sides.
Agreed - I already have a job where people come asking. If developing OSS came with obligations, I’d do something else instead.
Direct link to PDF:

https://s3.documentcloud.org/documents/24520332/merged-fb.pd...

Here is Meta's response:

https://ia802908.us.archive.org/29/items/gov.uscourts.cand.3...

Meta denies that they violated the Wiretap Act but offers no evidence of consent. (They try, but it is a laughable attempt.) Meta is also arguing the documents are not relevant. Meta claims the VPN app intercepting communications with other companies that sell online ad services, e.g., Snap, was not anti-competitive. It was just "market research".

Why is Meta so afraid to produce documents about "market research".

Meta does _not_ deny that they intercepted communications. From the attention this is getting on HN, MalwareBytes, etc. it seems clear no one using the VPN app would have expected Meta was conducting this interception. It is difficult to imagine how anyone could have consented to interception they would never have expected.

Additional details:

https://ia802908.us.archive.org/29/items/gov.uscourts.cand.3...

Apparently Facebook was using a "really old" version of squid.
Litigation including criminal prosecution
Given Snowden, I have to assume Cloudfare is under the thumb of at least the NSA.

For example, all the usual arguments against backdoors are going to be used by intelligence agencies to justify "providing assistance", which isn't even merely a euphemistic excuse given how incredibly valuable it would be for normal organised crime to spy on some of the encrypted data… but also is at least a bit of a euphemism, as I have to assume the controversies about terrorist groups using Cloudfare are only pemitted to happen because someone in US intelligence knows how to squeeze secrets from those groups.

In theory, messing with SSL is one of Cloudfare's features, not a secret; in practice I suspect most end users treat all this as magic — I've directly witnessed magical thinking with the padlock icon in browsers.
I think you’re saying “I would be surprised if there is only 1 exploit like this that already exists” which is what the previous comment was also saying. “If the prior is one” is often used to mean “we know for sure that there is one”.
I hope they do research and plant a variety of trees in sustainable ways that do not affect people negatively.

https://en.m.wikipedia.org/wiki/Hay_fever_in_Japan
Obviously, but the idea of creating a useful hash function in this case is to make it invariant under those sorts of to a human trivial transformations, whilst avoiding collisions between genuinely different content. Microsoft created something called PhotoDNA that tries to do this.
That was some sort of theoretical security loosening, it didn't contribute to the backdoor.
Boot from obfuscated VM running on a FPGA softcore?

Maybe on two completely different ones and verify for differences.
It's not like organizations writing proprietary software are magically immune to sleeper agents either. Social engineering is not a software or tech problem in general. Trust is required to get anything done, and can also be abused to hell and back by a sufficiently motivated actor.

But important software needs to be identified and proportionally more scrutinized by multiple independent parties, that's the lesson. Identification is the hard part. You can't easily determine that half of the world relies on this particular piece of software, or that it enables access to desirable targets.
Proton have a pretty nice platform now that replaces a lot of the gsuite offerings.

Kagi for search.
One of my friends started a website called "The Mortgage Lender Implode-O-Meter" to track all of the mortgage lenders going bust... in 2006. It is worth remembering that cheap credit with adjustable rates is what fueled that bubble and what made it unsustainable. A lot of the world (including Ireland) floats rates after the first 5 years of a mortgage.

Whereas in the US, anyone with a pre-2022 30-year fixed-rate mortgage now has a massive paper profit due to interest rates going up that can only be realized by slowly making their required payments. That gets vaporized instantly if they sell and pay off the mortgage.
Why Sonoma 14.4.1 was necessary
> I find it so insane that people think the major VPN providers aren't all completely compromised one way or the other.

For 99.9% of people a VPN is just something they use to access something in another country or because some YouTube ad scared them into believing you need a VPN as soon as you step into a coffee shop.

The threat model of most people does not include state actors or intelligence actors and they just don’t care.
The two groups looks for very different things in the media. One care deeply about it and appreciates many different aspects of it, and sometimes the intellectual challenge is part of it. They are utterly bored by most books and films.

The other group wants to relax and be entertained, not solve an intellectual puzzle.

Many are somewhere in between. I don’t care about an odyssey through some neo-Marxist mystery, but are utterly bored by Marvel iteration 25.
A Person WHO Was in Charge of OpenAI's $175M Fund Appears to Be Fake
Yeah. I wonder if MS dog food it
I do sometimes wonder if by trying to be "nice" to users and try to see the best intentions of commenters, many developers waste huge amounts of mental energy.

For context, I've really only worked on "fun" side projects, namely emulators and game remakes, where I've explicitly avoided any mention of donations or similar. Both as it's intended to be a distraction from my job, not become part of it. And generally avoid as many issues as possible around said money distribution within the project, and possible copyright problems that such things often skirt.

And those sort of projects tend to be extremely limited in progress not by total interest, but skilled interest with the ability to contribute. I wish as many as 1% of the regular discussion participants in the community could contribute to that level.

There's a natural belief that unless someone is egregiously out of line, all discussion around a project from users is allowed, even encouraged.

But many people just can't seem to help themselves making "suggestions" (or, another reading, "demands"), and that can have a significant impact on motivation of volunteers. I believe the vast majority are from based in good intentions, wanting a "better" result, but arguably are mostly self-defeating in that I find the discussion around much of these things to be draining and demotivating. I want to have "fun" coding game remakes, not defusing drama in discord threads.

But it's expected to have a "community" for all such projects, and not exclude non-direct contributors. Even writing it down here I'm worried I sound like I'm trying to curate a closed community of ego-boosting yes men.

But I sometimes wonder if allowing this sort of open community is better in the long run.
If an attacker is so smart and patient to pull of a sneaky supply chain attack like this, I'd say he/she/they must have been quite carefully choosing the moniker and hide/obfuscate other potentially identity revealing information (afaik, there is no reliable identity information found at the moment). So by choosing a very typical Chinese name (Jia Tan), I believe this is intentially misleading/smearing. I can't believe a smart ass (potenially a state actor) would be so stupid to use his/her/their actual nationality or other information.
My €5 VPN allows me to use 500 IPs in 50 countries. Give me the VPS that allows me to do that.
Salt-Size Sensors Mimic the Brain
Why would Spotify use those weights?
"May I direct your honor that my client is a wealthy tech billionaire who would otherwise be at risk of being slightly annoyed if they were sent to jail for intercepting private communications of competitors..."
I'm starting to feel that one of the lessons here is that individuals invited into trusted positions should be identifiable. Jia Tan is not a real person. We don't know who they are, so there is no way to hold them accountable.
The problem with Eternal September isn't that n00bs are stupid lusers - but that we do a terrible job introducing people into our culture.

So many online spaces seem to have an attitude of "if you don't already know the rules, you can't play". There's no helping newbies and neophytes learn the how and why of a community.

Most organisations are desperate for new members. And yet, when people show up, they're laughed at, blocked, or sent away.

Eternal September should be a cause of joy! Look! All these new people want to talk about our hobby! New friends to play with! New people we can tell our jokes to! New blood to help give us new ideas!

Instead, they're treated as an annoyance or irrelevance. Why is that?
It's not too hard to figure out. People are figuring it out. If anything is too hard, it's due to obfuscation - not C/C++ shenanigans.
As far as I understand from scrolling through these comments, an attacker can send a command that is used with the system() libc call. So the attacker basically has a root shell.
My argument is that infecting zero or one person is common.

https://en.wikipedia.org/wiki/Overdispersion

It's why you can get superspreaders without making the r0 a crazy high number. Most people don't transmit much if at all, but a few people transmit a huge amount. You can look at the actual curves if you want.
> forced by law

Which law?
Yes, unrelated. My point was that wheel-reinvention is a curse of the software industry because it's just so easy to reinvent every wheel on a whim. DevOps and is no different. How many large orgs have their own build tooling, or some special sauce around large repos?
You have to trust someone somewhere. You're simply placing your trust in the VPS provider instead of a third party VPN provider.

Not to mention the other stuff the VPN providers give you as standard which you'd have to implement and maintain yourself.
Very happy with Time Machine and Carbon Copy Cloner on my Mac. I have a dozen hard drives and SSDs that I rotate and a NAS, but I don’t use that for backup. Never lost a file. But a reminder to myself: I need off site backups.
I always thought most songs were too padded out. E.g chorus repeated 3+ times
Modern collectors have stop-the-world pause times in the millisecond range (aiming for less), even for very large heaps. Allocating threads may also incur allocation stalls, also in the millisecond range. However, these collectors need additional barriers in the application, and the concurrently running collector competes with the application for resources even if the application is not paused. Meaningful comparisons are difficult.
I get why, in principle, we should pay people for open source projects, but I guess it doesn't make much of a difference when it comes to vulnerabilities.

First off, there are a lot of ways to bring someone to "the dark side". Maybe it's blackmail. Maybe it's ideology ("the greater good"). Maybe it's just pumping their ego. Or maybe it's money, but not that much, and extra money can be helpful. There is a long history of people spying against their country or hacking for a variety of reasons, even if they had a job and a steady paycheck. You can't just pay people and expect them to be 100% honest for the rest of their life.

Second, most (known) vulnerabilities are not backdoors. As any software developer knows, it's easy to make mistakes. This also goes for vulnerabilities. Even as a paid software developer, uou can definitely mess up a function (or method) and accidentally introduce an off-by-one vulnerability, or forget to properly validate inputs, or reuse a supposedly one-time cryptographic quantity.
I doubt it has any practical advantage over just using HTML as-is. If you have a decent performing server, and lightweight pages the browser can render a in such a quick time you won't notice the load. For example try tabbing around the links in HN.
How did the comment in any way make it sound bad?
India rescuing citizens forced into cyber fraud schemes in Cambodia
Number of empty properties in Ireland dropped by 9% from 2016 to 2022
Transactional, relational-graph-vector database that uses Datalog for query
That's not obvious to me at all. What if a trove of pornography provides a non-violent alternative, meaning fewer children get hurt? Either hypothesis seems at least somewhat likely, and boldly claiming that one or the other is true should be supported by at least some evidence.

But even with AI generated porn, children get hurt indirectly imo, for the same reason using AI to generate art violates the property rights of artists.
PDM, ERP, SAP, WBS, COTS, WMS, CRDT.

I have no idea what anybody's talking about. I need that Reddit bot which explains the acronyms in a thread.
Melting ice solves leap-second problem – for now
it is a shame they don't do physical print through
Certainly not Trump.
Yes, I believe it's an state actor, and the intention of choosing a typical Chinese name Jia Tan is intentially and malicious.
> When someone logs into SSH and presents a signed SSH certificate as authentication, those hacked functions are called

So if I only use pubkey auth and ED25519, there's no risk?

Besides this, just to understand it better, if someone tries to login to your server with the attacker's certificate, the backdoor will disable any checks for it and allow the remote user to login as root (or any other arbitrary user) even if root login is disabled in sshd config?
People always say that but what do they actually mean? Restore one file, check if the backup is bootable in case it should?
So, this interacts with someone else's hosted model, or something open source you might host yourself. But these models are still more or less censored.

What does it take to build something like this that is completely sexually unshackled, that can do explicit things? I guess simply a lot of training material and money?
I often debate if I should go into the hacking world, best case I get bug bounties, worst case I get rich and I contribute immoral actions.

I think its far easier to make $3,000,000 as a hacker than a worker/entrepreneur.

Its way easier to find flaws/bugs than to do the entire Capitalism thing correctly.

Then I see that half of these major attacks required social engineering.... Maybe being a hacker is significantly easier. I only need to fool 1 person, there are a lot of people, and merit isnt exactly how everyone got to their position.

Anyway point being: People are amazed by hacking, they shouldn't be, its relatively easy if you are a mere 10 year programmer. Most of us pick relatively moral work, so the number of attacks are small. It is also why we really need to treat security on computers like its no stronger than your home's front door lock. There are too many attack vectors to be perfectly safe.
Yes it does but only if I'm writing the software. Otherwise, let all the data flow freely!
If you want to make a point about something being “not hard” maybe using a less messy command would bring that point across better ;)
Not everyone can take time off from their day job just because somebody paid them a nominal amount of money.

Besides, the maintainer in this case was already taking time off regularly, not to work on xz, but to get away entirely from any kind of programming work. Throwing money in his general direction probably wouldn't have helped with the burnout, unless you were offering to help him hire somebody.
It really depends on why are you trying to do. It is not easy (or just impossible) to get the same amount of ip with that $5/mo or $10/mo VPN services by renting your own VPS at the same price.
> It's not just good, it's way faster than the bloated alternatives.

I use Faststone, what am I missing?
bioawk: awk modified for biological data
That "Jigar Kumar" is like fake and one-time throw-off account, probably from the same state actor to orchestrate the painstakingly prepared supply chain attack (under the sun).
Shadowing Trump’s attacks on mental fitness — his own father’s dementia

https://www.washingtonpost.com/politics/2024/03/20/donald-tr...

>Trump avoids mention of his father’s Alzheimer’s disease as he lashes Biden for being ‘cognitively impaired’

>Donald Trump invited his extended family to Mar-a-Lago in the mid-1990s. As the clan gathered at the palatial Florida estate, though, his father was badly struggling, according to Mary L. Trump, Donald’s niece.

>Fred Trump Sr., the pugnacious developer then in his late 80s, didn’t recognize two of his children at the party, recalled Mary L. Trump, who attended the gathering. And when he did recognize Donald, the family patriarch approached his son with a picture of a Cadillac that he wanted to buy — as if he needed his son’s permission.

>The incident, Mary L. Trump said, left Donald Trump visibly upset at his father’s descent into dementia, which medical records show had been diagnosed several years earlier. Trump reflected his anguish in an interview around that time, with Playboy in 1997 reporting that seeing his father “addled with Alzheimer’s” had left him wondering “out loud about the senselessness of life.”

>“Turning 50 does make you think about mortality, or immortality, or whatever,” Trump, who had recently reached that milestone, told the magazine. “It does hit you.” [...]