skysight-inc/HackerNews huggingface dataset:
A bit premature to declare so, don't you think? What if it comes out that corners were cut regarding engine maintenance or something along those lines?
There were several parts to it. For one, the control flow was non-standard, as the initial code hid itself into an ifunc for CPU capability resolution. From there it patched its own return address and branched into functions with plausible but misleading names that continued on to patch the table prior to RELRO kicking in.
We have a street lined with those. To me it smells like vomit.
Yeah, it's left me a little disappointed in Arch in particular that they didn't follow the lead of Debian and Fedora and revert to a much older version, instead just building 5.6.1 from the git repo and basically defended it as "the hacked build script checked for dpkg/rpm anyway".
I, sir, am not saying it was. Yet pointing out how it could be, In some hypothetical past or future scenario, a reality worth considering
"adding humans to the mix" is not the most unrealistic thing by far, in that uneven film. The basic premise (suns do not forget to shine one day) and proposed fix (any human efforts would be of insignificant scale compared to a sun) take that honour. The third act of the film is a runner-up.
The engine failing isn't some random, unlucky event. Regular maintenance and inspection should prevent this. Whenever this happens to an airplane it's considered negligence - there's no reason why we shouldn't have the same standards for ships.
That's just love coverage CNN and major news do nowadays. Find the live event page and there's minute by minute updates, background information / quick recap, other sources and links, images, etc all updated in real time.
It is very difficult for EDR to detect something like this, because it would look like a SSH connection.
WASM based "durable-execution" [video]
my gut instinct is that xz needs to be rolled back to its pre-attack state, but obviously that would probably also reintroduce some bugs and likely break some things. Still, very curious to see some analysis on the impact of doing so, because this article points out, xz is in a critical path for lots of system level processes.
They say "you need to fail to succeed". The key thing is that it is not enough to fail, you also have to reflect on why you failed, and this is the reflection which has you progress.

It is not the failure itself which is progress, it is the act of failing, then feeling BAD, and then thinking about how not to feel BAD anymore. Failure without feedback is pointless failure. (This is the same idea than deliberate practice.)
Yes! I believe this happened when they made containers natively compatible with “Mozilla VPN”.

They do advertise their own service, but there’s an option to use a custom proxy instead.
Not if the attacker uses it just to gain an initial foothold and then extends their access through other means.
You should read the articles and not just the titles. It was never in production.
Location: Lahore, Pakistan

Remote: Yes

Willing to relocate: Yes (require sponsorship)

Technologies: React, Typescript, Ruby on Rails, Laravel, Javascript, MySql, Psql, Aws

Résumé/CV: https://drive.google.com/file/d/1hcBNodFwJ88ZepLV-7lIPTNx1-3... / https://www.linkedin.com/in/afzal-ali-9ab284137/?lipi=urn%3A...

Email: afzalali2728@gmail.com
But why would the entire behind this submit all their attacks through the same single identity? Removing all this code could just be removing 1% of their harmful code. How do you deal with the rest? How do you discover the other identities?
The reality is complicated, there are liability arguments on both sides and a deal to be struck that'll land most costs on one party over another.

* Where were the tugboats?

* Why did the boat leave the pier with a faulty engine?

The ship was still within harbour waters under the control of local harbour pilots. They didn't have tugboats within near distance and they took the engine status on good faith.

As a risk management exercise if you run a harbour with high traffic then eventually a ship will have an engine|rudder|other failure within harbour waters and bridges will be struck with glancing to major blows.

It's an older bridge built before ship sizes grew, was the harbour infrastructure lagging behind the nature of the traffic it purported to serve?

Other harbours have pylons protected with substantial barriers, other harbours ban traffic | workers on cross harbour bridges when ships move (eg: Tasmania after they had a ship hit a bridge).

The ship maintainance was very likely at fault, the harbour should have mitigation plans against ship faults, etc.
> What if xz contains a hidden buffer overflow or other vulnerability, that can be exploited by the xz file it's decompressing?

If you generalize this problem further, to all packages, then the only reliable solution is security through compartmentalization. On Qubes OS, any file I open, including .jpg and .avi, can't have the access to my private data or attack the admin account for the whole computer. This is ensured by hardware-assisted virtualization.
Nice! I've recently discovered direnv too and can't believe I've coped this long without it. I currently use virtualenvwrapper and direnv to activate those (I much prefer having the venv root outside of the project dirs; not everything respects gitignore files by default).

I didn't know about uv and PDM. I use pip-tools and there has been some work to adapt it to support multiple Python interpreters. My main gripe is it can't be installed once with pipx, for example, and just work. But it seems difficult. Perhaps uv suffers from the same problem. Interested to see how PDM deals with it.

> While direnv has built-in support for the standard library’s venv module, it’s glacial. virtualenv is much faster, but uv is faster, still.

I've never been bothered by the speed of venv. It does what it needs to do in milliseconds and it's not like I'm calling it that often. Why is the speed of it important?
That gets your account banned, not deleted. You can get it back at any time by promising to not do it again, and sending a copy of your ID.
> Redis is partly where it is because of large FAANG companies contributing to redis, that cannot be discounted.

Redis is offered as a managed offering by AWS and other because it was already very popular between developers that were clients or potential clients of cloud vendors. That it is/was used also by FAANG companies doesn't change a thing in this part of the story. (And no, I don't believe Redis is popular because it was used by FAANG companies which also contributed back)
Quick search shows that there was was quest in Call of Duty that involved decrypting a floppy disk, and there is a walkthrough here from ... November 2020

https://www.ign.com/wikis/call-of-duty-black-ops-cold-war/Ho...
“Jon Stewart says Apple told him not to interview FTC chair Lina Khan”:

https://amp.theguardian.com/media/2024/apr/02/jon-stewart-in...
> I suspect a "white's only" association wouldn't disgust many people, on the basis that we can have black or girl-only associations and they are fine. It would still be racist, obviously

Well, it would disgust me. I have so-called mixed-heritage children and I dread the day when I have to explain to them that they can't join this or that activity with their friends because they have the wrong skin color or the wrong gender.

I may be in the minority, but I find associations that exclude people based on any of the protected classes (gender, sexual orientation, etc.) very distasteful. By all means, feel free to organize an event centered around X community, but allow everybody to attend.
Selling to a state actor is also likely to be illegal depending on the conditions of the sale and who the buyer is.
We'll see. I don't think that would help them if and when it pops. The survivors/big players tend to suffer disproportionally with regard to the actual fundamentals (look at dot-com again for comparison).

I think it's quite clear that we are both in a bubble and GenAI has a lot of potential for productivity gains and maybe even further utility beyond that.
Because the money isn’t a bailout, it’s to incentivize intel to do a financially suboptimal thing that the US finds strategically desirable.

If building and running the fab in Arizona versus Ireland is going to cost intel $8b more, the options are do nothing and don’t get the fab, or pay the difference. Even if they are doing stock buybacks it doesn’t mean you can force intel’s shareholders to take a $8b loss without compensation - that’s a clear takings clause violation.
People complain lot about python packaging, have complicated setups to work with it, and invent new tools all the time. In the meanwhile, I just use vanilla pip and venv with Debian Stable provided python like a caveman, and I'm... mostly content? For smaller stuff, I tend to use just Debian provided python packages, for the rest just (project-local) venv. Sure, there is occasionally some hitches, it's not perfect, but I haven't yet felt the need to reach for anything else.

I bring this up because this is such a common topic to complain about, and there is this sentiment that Python packaging is completely broken and unusable. But for me, and I suspect a large quiet userbase, stuff just works fine, and I don't think this side gets brought up nearly enough. And for people not actively using Python, it's important to note that you don't need a rube-goldberg setup like in TFA.
One thing that comes to mind is that “Jia Tan” might be more accurately seen as a “sleeper” of some sort: a foot soldier who infiltrates a juicy open source project and waits for further instructions; backdooring sshd might not have been part of the original plan.

Which raises the concerning question of how much more sleeper maintainers there are.
Which country's business leadership did you hear that from?

I'd be fairly surprised that American disposable purchasing power would fall to around $3-4k USD a year, unless by "middle class" your peers meant the professional class in China (the kind that can afford to splurge on a new iPhone every year, buy a Xiaomi SU7, and send their kids to do a bachelors degree at UCB, UCLA, or UIUC), in which case I wouldn't be too surprised simply because of how much growth was captured by that subset, and salaries for that subset are at France/Germany levels, but those countries also severely underpay professionals tbh.

Even professional salaries at employers like Google India or Gojek Engineering in Bangalore, Jakarta, etc can pay German or French level dev salaries, let alone the subset of similar companies in China that can afford to pay around $20-100k USD salaries (depends on the city)

> signal on 1) experience with new EUV processes and 2) cost of labor. That's not taking into account the expensive EUV amortization

Yep. There's a reason Intel and GlobalFoundaries have the last American owned Fabs - most other players left the industry in the 2010s due to the massive costs, though it's a similar story in China as well which was only solved by the "Big Fund", but a similar Cambrian die off happened in the 2017-20 period which basically only left SMIC (comparable to TSMC or Intel in the early 2010s), Hong Hua (comparable to Tower), and YMTC (comparable PSMC or SK Hynix)
It's like security 101. If a system has been infiltrated, you can't trust any part of it. So it's better to discard any part that has been reached or possibly affected.

Perhaps it's the correct action to distrust xz/lzma or any source code this team has control over and switch to alternatives. If there are no alternatives, to start ones.
Great series. If I'm not mistaken, there's an additional layer to the unreliable narrator part because the book is supposed to be a translation of that biography. So, when certain words are used, the reader knows that they don't necessarily represent the literal meaning and it's only an approximation for the actual thing in the book universe (for example, a "horse" is not actually a "horse" as we know it). It certainly helped me digest the more outlandish ideas.
It's probably as easy as modifying "extern struct rtld_global_ro _rtld_global_ro", exported from ld-linux, the dynamic linker/loader. During IFUNC resolution this struct seems to be writable.
I don't know of any official source. But reading between the lines:
Murati also told the Journal that Sora is “much more expensive”.
And just how few sample videos they have output. The point of AI generated content is you _never_ need to reuse it, you can just generate more.
My bias was always to err on the side of popularity. I thought that I would be less likely to encounter frustrating bugs and edge cases using choices that have been battle tested for a least a few years.

What I overlooked is that while the platform might be popular and mostly trustworthy (such as Vercel), there are specific solutions like the Vercel Cron Job are still relatively new (released Feb 2023) and still not ready for serious use.
Once AI has been used to launch a successful cyber attack on any vital resource and it gets into the press
> We all mostly want the same things, feel the same things and do the same things, both good and bad

The irony is that it’s clear from this affirmation that you are a man, because any woman knows how false this is. This is the same for pretty much any situation where some group dominates another: the dominants think everything is fine because they don’t experience any discrimination and don’t understand why the dominated complain and are "so fixated on gender" (or race, etc).
I don't think you should have been downvoted, but it's pretty clear that this would be a crime.
> the only reliable solution is security through compartmentalization

I hope we get there eventually. Not just for standalone processes, but for individual libraries. A decompression library could run inside a WebAssembly sandbox, with the compressed file as input, the uncompressed file as output, and no other capabilities.
I'm guessing NextJS because internal tools need to make requests inside the DMZ without authorization.

(The huge mental disconnect between people who only ever make websites and people who make business tools is amazingly huge.)
Gender is an opinion, but it is a sufficiently coherent opinion across different people and different times that it can be studied and discussed from an almost objective historical and anthropological perspective; the "evil spirit" cannot claim that, for example, typical blacksmiths in stories are not male.
outlandishly expensive infrastructure projects are in the US

As someone in Europe I wonder where this notion comes from. Just about every major (and several minor) infrastructure project I can remember in my lifetime, in any of the European cities I've live in, has been both late and wildly over budget
All hype cycles involve bubbles and bursts. The point is on a longer time scale the growth happens anyway... look at the .com bubble followed by the internet eating the world. Things just take longer than you expect and initial leaders tend to fall behind. The big question here is where OpenAI and Nvidia will be in 10-15 years... my theory is that chips will be mass produced as we've seen in past waves bringing costs and valuations down for Nvidia... meanwhile OpenAI's death grip from Microsoft will strangle it slowly into an AOL like outcome
> Lots of developers here, but also in the media, believe GPT is the precursor for AGI. Which is ridiculous; it's just an incredible token predictor. Its language capabilities might be useful, but AGI won't be possible without a self-correcting model that can actually reason. Even Altman hinted at that.

I think part of this is that all three letters of the initialism mean different things to different people.

To me? The domain is broad rather than narrow, so it's got the "G" of "AGI".

Definitely agree it is not a complete solution, and thus that reasonable people will say "no Ben this isn't general what are you talking about".

I also definitely agree isn't superhuman, but I think superhuman ability across all of its domain is an unreasonable requirement for AGI and what I would instead call that ASI… but I'm also a linguistic descriptivist, so it doesn't matter if the consensus is unreasonable[0] just what the consensus actually is.

Also: my understanding from "Fine-Tuning Language Models from Human Preferences"[1] (in particular the summary version of the bug, "The True Story of How GPT-2 Became Maximally Lewd"[2]) is that these models are capable of self-correcting behaviour — we just don't do that live because that makes it much harder to research and to use (every time it even seems like the ChatGPT model changes, someone complains).

> But it will keep getting stuck on the accuracy part

I suspect otherwise. Some — not all, but some — domains have easily testable results. In these domains, the generated output can be quickly tested, and used to update the model.

This is already done with human preferences, but I'm thinking more along the lines of a coding assistant which gets feedback from a compiler, or a maths assistant which gets feedback from… maths isn't my field, I'm just going to say MATLAB or the Wolfram Language and hope these are both as highly regarded as Photoshop.

[0] this happens a lot: tautologies such as "ATM machine"; or redefinitions such that "PC" excludes MacOS and all phones and tablets; that Elon Musk can only be called "African-American" by pedants (including me, despite being a descriptivist); exactly how effective and how altruistic is "Effective Altruism" etc.

[1] https://arxiv.org/pdf/1909.08593.pdf

[2] https://forum.effectivealtruism.org/posts/5mADSy8tNwtsmT3KG/...
I've never been very fond of nature to begin with[0], but I never imagined becoming disgusted by trees. That's until seeing some four different tree species mentioned in this thread, whose common characteristic seems to be the aura of shite and decay that takes years or decades to break through people's desperate need to pretend that since it is nature and handles well, it must be good.

--

[0] - Specifically at human/humane, live in and breathe in and admire it scale. I'm very fond of nature at population scale, and at molecular scale, both of which present interesting puzzles and applications.
I agree with the sentiment, and it's prevalent in modern feminism - to the point of inventing words to deprive half the population the right to speak, but in this article the author is trying to do the exact opposite?
I'm not sure, because I haven't been to the US in more than ten years. Last year in Canada everything worked flawlessly
It's neverending comedy with people equating autocomplete tool with nuclear bombs, mass shootings etc.
I don't follow tennis closely enough to understand the difference. What makes the eventual winners at Wimbledon play more aggressively than at the French Open? Is it due to the environment (clay or grass perhaps) or some sort of cultural thing?
The profits are also socialized, in that a huge chunk of US people are hurt financially when the bridge goes down, illustrating how most of us benefit from having stable flow of goods and services.

If you (and millions of others) did not benefit from having this bridge, then you (and millions of others) would not now have lower quality of life when it fails.
With a little forum experience, who has trouble scanning a thread and seeing it meander away from their interest? So I question the need.

Even if there is the need, who should be the judge for others over the quality of a subthread? I would feel presumptuous to pass judgement beyond my vote for each comment.

Aren't those diamonds all that matter anyway? Recently I increasingly find new and curious beginnings dampened and limited by intellectually lazy attitudes, by comments that start with "I mean...", that reiterate the default state rather than entertaining a new thought. Inadvertently, well-meaning soft-moderation like yours might steer even more people away from interesting topics.

I'd say, leave your vote and move on.
> initial implementation is only there to learn the domain

I've been trying to do a kind of documentation-driven development, where I write a fairly detailed README file before I write a single line of code. It hasn't gone as smoothly as I imagined, I think it takes practice to get more effective - similar to test-driven dev. And it made me realize my usual approach is "to think by coding", and to explore the problem space with a rough draft of a program.

It must be a common approach, as I've heard people say "Throw away the first draft." Not only in programming but about writing in general. Ah, there's even a term for it:

Throwaway prototyping - https://en.wikipedia.org/wiki/Software_prototyping#Throwaway...
> I use different mechanisms to manage the virtual environments depending on whether I’m developing a *package* without strict pinning or an *application* with strict pinning.

I assume that by “package,” the author means library?
Thank you for the interesting write-up.

It feels like societal satire in this vein is becoming rare. I fondly remember sci-fi movies like Starship Troopers, Robocop, Brazil or even They Live, but not much about recent times. Maybe Don't Look Up comes close, haven't watched it yet.
And you think there's phone signal on the middle of the jungle? Sometimes hundreds of miles from the nearest asphalt road?

Check google maps and see how you'd get to and from here (notice, getting up here would be the "easy" part of the journey - there's even "street view" https://maps.app.goo.gl/2XEL3J3aJWoLEGY58 )
IIRC Debian has wiped and is rebuilding all their build hosts, so yes.

But while I understand what you mean, I would not call improving the security of a piece of software “halting progress”. Security improvements are progress, too. Plus, revisiting processes and assumptions can also give opportunities to improve efficiency elsewhere. Maintenance can be an opportunity if you approach it properly.
It's impossible to insure against in any practical terms.

The way forward is to invest heavily in a much more security-oriented kernel(s) and make sure that each program has the bare minimum to achieve what it offers as a value-add.

The human aspect of vetting seems like an impossibly difficult game of whack-a-mole. Though realistically I doubt that the bad actors have infinite agents everywhere, this also has to be said. So maybe a "sweep" could eliminate 90% of them, though I'd be skeptical.
I independently discovered base36 for a personal project recently and was very happy to have an explanation for why Python's base conversion goes up to 36.
To me the silliness of Event Horizon fits the tone of 40K well. People who decided it's supposed to be taken seriously seem the same as those who don't realise Batman isn't a serious way to attack crime or that Judge Dredd isn't an endorsement of militarised police.

This is why I'll pay Relic but not Talisman, the Talisman game is very silly, but Relic sets it in the 40K universe where it makes sense. Or rather, it makes no less sense than everything else.
You can't really remove dependencies in open source. It is so intertwined at this point that doing it would be too expensive for most companies.

I think the solution is to containerize, containerize and then containerize some more times and make it all with zero trust in mind.
Other than hearing and dismissing a few people online suggesting this incident was an act of terrorism, I hadn't really thought further about it until your comment which made me go "oh... yeah, that does sound like it might be extremely feasible for a future attack, fuck."
You maybe haven't actually spent any time in Sweden and compared to how people act towards each other there compared to other countries? Or, you haven't spent enough time in other countries than Sweden, making it hard to compare.

I lived there for my first 20 years, and have since lived in Spain. The amount of trust between people in the Nordics is definitely higher than most other places in the world.
> How could it be a construct of our modern times if their themes are consistent throughout history of humankind?

OP didn’t talk about "our modern times".