skysight-inc/HackerNews huggingface dataset:
An EDR would have detected an inbound connection to port 22.
Then it'd have detected the attacker's activity (opened files, executed commands, etc)

If the EDR is capable of intercepting the forks, clone() execves, open(), etc, then you can follow the traces.
If it's able to deny certain activity based on rules like modifying /etc/ld.so.preload or download files with curl/wget, it'd have made the attacker's life a bit more difficult.

If the attacker loaded a rootkit, then probably you'd have lost visibility of what the attacker did after that.
Also not all the EDRs hook all the functions, or they have bugs, so many times you are not able to follow a trace (without pain/guessing).

This telemetry usually is sent to a remote server, so the attacker could not have deleted it.
Because that’s what people want. That’s how you can get a really good developer experience similar to golang or other languages. Just install one tool to build, lint, format, run tests, run your local project. No time spent trying to setup a bundler when what you want is to build a new project.

Regarding runtime libraries, it’s similar to the battery-included approach of go or python, you get what you need to get started out of the box and only reach for dependencies when you want to go further. Testing library, an http server, a websocket server that’s perfectly reasonable to have as core library of a runtime developed to run web servers.
Neat!

If you want something like this specifically for Mullvad VPN, I've had a good experience with https://github.com/imiric/mullvad-proxy (not my project, just forked it for some updates). What I like is that it embeds the Mullvad CLI tool, so switching servers is trivial, and it's all isolated from the host machine. It's also "just" nginx and some scripts, so it should have good SOCKS5 support.
Accounting for the lowest common denominator that has a huge share in it is always a great plan. Every trading platform out there uses "+-ddd.ddd" format, even binary-born protocols completely unrelated to js used it since forever.
One version would be to actually leave the expression as is and temporarily switch the Lisp reader to Infix.

I'm loading an infix reader macro into LispWorks, the code is roughly 30 years old:

CL-USER 1 > (ql:quickload "INFIX")
To load "infix":
Load 1 ASDF system:
infix
; Loading "infix"

;;; *************************************************************************
;;; Infix notation for Common Lisp.
;;; Version 1.3 28-JUN-96.
;;; Written by Mark Kantrowitz, CMU School of Computer Science.
;;; Copyright (c) 1993-95. All rights reserved.
;;; May be freely redistributed, provided this notice is left intact.
;;; This software is made available AS IS, without any warranty.
;;; *************************************************************************

("INFIX")

Now we can write Infix expressions:

CL-USER 2 > '#I( a + b * c )
(+ A (* B C))

Let's set the variables a, b, c

CL-USER 3 > setf a 10 b 20 c 30
30

The Infix expression reader macro at work:

CL-USER 4 > #I( a + b * c)
610

Inside the Infix macro Lisp parses a sublanguage of Infix expressions into Lisp s-expressions. Generally this would be possible with a normal macro, but the reader also changes the tokenizing of elements, so we can also write:

CL-USER 5 > #I(a+b*c)
610

In "normal" Lisp syntax a+b*c would be a single symbol. The infix reader parses it into five symbols and a list according to operator priorities.
There are no numbers in JSON. There are only strings.
Los Alamos Chess
Instructor: Structured Data Like JSON from Large Language Models
One wonders what worries the Japanese had about the year 2024 back in 1517.
Upstream WireGuard (golang) has had this capability for a few years now: https://github.com/WireGuard/wireguard-go/tree/master/tun/ne...
First thing that I check before using a JSON parser library is that if it lets me to get the number as a string and let me do my own conversion. Libraries that try to treat the number as double or bring in a large bigint/decimal library gets usually pass from me.
Sibling doesn't really cover the benefits vs. Go, so here's my attempt at a list.

* Rust offers memory safety without a GC. You may or may not want a GC. If you don't, then Rust is the better option.

* More broadly, Rust has a C++-like focus on providing zero cost abstractions. Go is generally happy to accept a small runtime cost for abstraction.

* Rust can generate small WASM targets because it doesn't need to bundle a runtime. Go can target WASM too, but you either need to accept much larger object sizes or use TinyGo, which doesn't implement all Go language features (although it's pretty close now that generics support has arrived).

* Rust code generally runs faster (although a lot depends on whether you're writing the kind of code where a GC is a net positive or a net negative for performance).

* Rust has a fancier type system that's much more able to express invariants. If your happy place is a place where the type system proves that your code is correct, then Rust will make you much happier than Go. The Go type system (and the culture around Go more generally) tends not to favor elaborate abstractions built on types.

* Rust has fully-featured macros, if that's your bag.

I think there are also some disadvantages of Rust compared to Go, but I've only attempted to list the advantages here.
IRS doesn’t calculate your withholding, you (and your employer) do. If you end up owing money at the end of the year, you probably failed to properly update your W4. For example, my employer only withholds 22% on RSU grants. It’s my responsibility to update my W4 to withhold extra from my regular pay to compensate, or make estimated quarterly tax payments.
https://4321.vn là một trang web đa dạng và toàn diện, hứa hẹn mang đến cho người dùng trải nghiệm lướt web thuận tiện. Trang web này cung cấp mọi thứ mà bạn cần, bất kể bạn đang tìm kiếm tin tức mới nhất, mạng xã hội phổ biến, công cụ hữu ích hay nội dung giải trí.
Giao diện của 4321.vn được thiết kế sáng sủa và rõ ràng, giúp người dùng dễ dàng truy cập đến mọi loại trang web và tìm kiếm thông tin một cách nhanh chóng. Điều này giúp tiết kiệm thời gian và năng lượng cho người dùng. Dù bạn là người đi làm, sinh viên hay người yêu thích giải trí, 4321.vn là lựa chọn lý tưởng cho cuộc sống trực tuyến hàng ngày của bạn, mang đến sự tự do khám phá thế giới Internet.
Với 4321.vn, bạn có thể tìm thấy thông tin về phim và truyền hình, hoạt hình, ẩm thực, tin tức, giải trí, game, mua sắm, du lịch, xem bói và nhiều nội dung khác. Bên cạnh đó, trang web cũng cung cấp các dịch vụ như xem phim trực tuyến, nghe nhạc và karaoke trực tuyến, diễn đàn âm nhạc và nhiều tiện ích tra cứu khác.
4321.vn là một trang web đáng tin cậy và thuận tiện, mang đến cho bạn trải nghiệm lướt web tốt nhất. Hãy truy cập và khám phá thế giới Internet ngay hôm nay!
Location: South Africa, JHB
Remote: Yes
Willing to relocate: Yes
Technologies: Typescript/Javascript, Python, AWS, Web (html/htmx, CSS)
Résumé/CV: https://docs.google.com/document/d/1zXWZdZvwHIhb0j3f5DGrt2wTIa04R1Mt/edit?usp=sharing&ouid=100197009939102746754&rtpof=true&sd=true
Email: tiisetsomurray at gmail.com

Industrial engineer and software developer. I've worked in manufacturing, insurance, logistics, and healthcare across startups and medium sized firms. I look at problems through an efficiency x efficacy lens by default. Available right away.
What I saw in a YT video related to piracy [0] was that game companies remove their DRM after the game has been effectively pirated, since it doesn't really matter anymore, and cost them money + worse experience for paying end-users.

The guy in the video makes the point that: Game is released --> paying users suffer the lower perf caused by DRM while pirates crack it --> pirates succeed, company removes DRM, paying users benefit from improved perf ^^

[0]: https://youtu.be/_Fu4pE46-zM
"When the average price of bananas in the U.S. goes above $0.60 per pound, it is likely the signal of a major macroeconomic event."

I'm not sure this person understands what "macroeconomic" means. Also it's the headline but merely asserted and then unsupported. Why is it a supposed macro event? Also why would I care about the particulars of banana history in an article putatively about a macro indicator?

"All information on Banananomics is AI generated from the global market graph and is provided for informational purposes only. It is not intended for trading or investing objectives."

Ah...
I think the easiest way to collect the Lego pieces from the floor is by using a vacuum cleaner.

Then look at the sorting as a separate problem :)
You can communicate the same without the snarky tone
That's excluding carbon capture, which is expensive. Blue hydrogen is being talked about a lot but isn't being produced at any scale worth talking about currently. Most hydrogen is grey hydrogen and a tiny amount of it is green hydrogen.

This system proposes using hydrogen to create natural gas. Using grey hydrogen for this doesn't make any sense. It would be more efficient to just use the gas directly. You'd end up with more gas for less money. Even if you capture the carbon and somehow manage to get some cheap blue hydrogen it still doesn't make sense. Especially if you then go and burn the gas and dump the carbon back in the atmosphere. This plan only makes sense with green hydrogen. Which remains expensive.
Just fyi your „trusted by“ section has layout issues on mobile (iOS). The displayed brand logos are not alligned correctly :)
Most Dangerous Button [video]
Reason why I ask is that there are many form/survey builders out there, as people often underestimate the complexity it takes to set one up that supports things like max diff, routing etc.

Looking at the forums I can see that some have managed to achieve what you need via plugins (albeit the one I see that is confirmed working seems to be paid…)

Just thinking contributing an open source plugin to a great open source scripting tool would save you headaches down the road :)
Agreed, they certainly can be/are useful (and fun!), in a multitude of ways, but all too often I've also encountered peoples' "complaints" that they bought a bunch and now don't have a use case for it/are searching for one :)
As this backdoor has shown, extra unnecessary files in the source files can make it easier to hide malicious code. If you take Gentoo as an example, when a software package is built, Gentoo creates a sandboxed environment first, disallowing the build process from impacting the rest of the operating system.[1] Removing superfluous files from the source tarballs minimises the ability for an attacker to get malicious code inside the sandboxed build environment.

Sandboxes for building software are commonly used throughout Linux distributions, but I am unsure how strict those sandboxes are in general e.g. whether they use seccomp and really tighten what a build script can get up to. At least on Gentoo, there is a subset of packages (such as GNU coreutils) that are always just assumed to be needed to build software and they're always present in the sandbox. Build dependencies aren't as granular as "this build needs to use awk but not sed".

[1] https://wiki.gentoo.org/wiki/Sandbox_(Portage)
The UK has sold Israel arms to the value of £489M since 2015.
For Python releases, this is quite a big problem. Python packages consist of many different downloadable files - for example, the Datadog APM library has over 60 different files[1] depending on the platform and Python version.

There's nothing to enforce that each of these files contains the same code - and indeed, they shouldn't: each platform-specific .whl file contains platform-specific binaries.

But for the python and other platform-agnostic code, it can and does differ if the publishing process is done manually.

One example of this is an intel project called "devcloud" - a specific file was included only in the .whl release (and not the source distribution) that contained an AWS access key[2]. The Amazon pay SDK also fell victim to this - the developer accidentally included an integration test that contained a key[3]. Someone else included a markdown file containing ~400 OpenAI keys in a similar manner, only present in a single .whl file out of several.

There are _lots_ of examples of this, so many that I created a project to attempt to quantify this, prevent accidental credential leaks and bring greater visibility to the contents of PyPI by publishing all the contents of PyPI releases to Github and indexing them: https://py-code.org/

There's a hosted clickhouse dataset available here: https://py-code.org/datasets. On my to-do list is to write a query to find differences in files within the same package version, where they should be the same. This is almost always an indication of something malicious or accidental.

"Package integrity" is a really interesting + complex area when you add a platform-specific dimension to it. For Python specifically, I wonder if the "separate whl per platform" approach is a good one. Maybe a layered approach would be better - the "source" is the source of truth, and pre-built binaries _only_ contain pre-built binaries and not the duplicated "source"?

1. https://pypi.org/project/ddtrace/#files

2. https://inspector.pypi.io/project/devcloud/0.0.2/packages/9f...

3. https://inspector.pypi.io/project/amazon-pay/2.5.1/packages/...
We've used XML for interchange of order-like data. Customers have started demanding JSON, so I built a tool to generate XML <-> JSON converters, along with JSON Schema file, based on an XSD, so we could continue to use our existing XML infrastructure on the inside.

I must admit I totally forgot about the JSON number issue. Our files include fields for various monetary amounts and similar, and in XML we just used "xs:decimal".

Most will be less than a million and requires less than four decimal digits. But I guess someone might decide to use it for the equivalent of a space station or similar, ya never know...
Location: United Kingdom

Remote: Yes

Willing to relocate: No

Technologies: NodeJS, TypeScript, PHP, ReactJS, MeteorJS, Docker, AWS - Full Stack

Résumé/CV: https://www.linkedin.com/in/bensquire/

Email: See Profile
I advocate for checking in the auto-generated code. You can see the differences between the tool runs, can see how changes in tooling affect the generated code, can see what might have caused a regression (hey it happens).

Sometimes tooling can generate unstable files, I recall there was time when Eclipse was notorious there, for example when saving XML files they liked to reorder all the attributes. But these are bugs that need to be fixed. Tooling should generate perfectly reproducible files.
Eclipse Temurin 21 and 22 Available on RISC-V
The audience for these types of announcement is bigger.

My intuition is that there are many more consumers of node-like environments today than any runtimes 15 years ago.
If you need a specific exotic JSON parser to parse the numbers you have correctly, I would argue that you should serialise them as strings and not as numbers.

That's what prometheus is doing for example. https://prometheus.io/docs/prometheus/latest/querying/api/
If you're going to download both the tarball and the got repo and verify the reproducibility of the tarball, then why bother with the tarball at all? You already have the got repo.
>- code can only be tested with an integration test

Some code only makes sense to test with integration tests. It's not more effective with a code base where somebody has decided to fatten up the SLOC with dependency inversion just so that they can write some unit tests which test that x = x.

>- code is tested by comparing the stdout with an earlier version (hopefully it’s deterministic!)

Making the code deterministic or adapting the tests to accommodate that it isn't should be next on the ladder, not hoping that it is.
Ask HN: Is AngelList Legit?
I've been investing in a few startups through AngelList. On the platform you can invest in startups, through a special purpose vehicle which invests in the startup via a SAFE.

Recently a syndicate lead posted such a clueless update on a startup (claiming their product passed a milestone it clearly did not, based on just reading their public updates), that I started doubting whether they've actually invested in it at all.

This made me question the platform. How do I even know these leads have invested my money in the startups they say they have?
I know this is contentious, but one factor here that lines up with the timeline you've presented is: vaccines.

Children are given far more of them than adults. People moving from developing countries to developed countries won't receive as many. But if they have kids in a developed country, their kids will get a ton.
Every commit in git repository is effectively signed by the commit hash. You can't sneak in any unreviewed changes.
I think is that modern languages like Go and Rust (there are for sure others, but I don't have experience with any other language that ships with all the tools) ship with all the tools you need, formatter, linter, test runner, etc, Go goes even further than Rust and ships a very complete std focused on web and Javascript is used primarily in web, so it makes sense that ships with all the libraries needed to build a web server, also websocket is a standard, so it's easy to implement it and make it work with the browser.

Nowadays if you start a new Javascript project you need to setup, vite/esbuild/webpack, eslint/oxlint/biome, prettier, typescript, etc, that is a ton of dependencies that YOU need to maintain for years, and if it is part of the tool you are using, then you don't, ideally there shouldn't be a breaking change, let's see how bun manages that when the time comes.

I am waiting for bun or a tool that has everything I need to bundle my frontend app, I'm very tired of fiddling with all the dependencies and try to make to work every dependency together, I have a legacy project that I work on, I would have migrated a long time ago to another tool, but there is none that would fix the current issue and it's managing the project build, test, formatter, lint dependencies, after using Rust I feel super frustrated with the Javascript ecosystem state.

Also you asked why? I want to work on the project, there is already a lot of work to maintain the dependencies up to date, the tooling should not be part of that work.
That only works if you are the one who serializes the json in the first place.
The tarballs also contain source. Just not the source control/revision history.
"If your full-time, eight-hours-a-day, five-days-a-week job were to look at each image in the dataset for just one second, it would take you 781 years."

So if we take 781 people to do this job, it'd only take a year? With about 1500 workers it would only take 6 months? Seems important enough to do.
IMHO the best course would be to freeze xz-utils. No new features but still keep it around so people can work with their existing xz files.

People who want new features should switch to other projects like zstd.
Location: Amsterdam (Europe, CET timezone); at the moment.
Remote:Yes
Willing to relocate: Yes
Technologies: R, Wordpress, GraphPad, open to learn new technologies.
Résumé/CV: upon request
Email:wieke95@gmail.com

I am a woman who is a beta person and learns technical skills quickly. I have studied biomedical sciences and neurosciences. I like to become better in machine learning and increase level of programming.
One could easily argue that everyone, except Americans, take their vacations seriously considering the lack of labour laws in the United States.
--

Location: Gurugram, India

Remote: Yes

Willing to relocate: In India

Technologies: Ruby, Python, C/C++, Ruby on Rails, Django, HTML/CSS

Résumé/CV: https://linkedin.com/in/karan-ydv

Email: karanydv.work@gmail.com

--

I have overall 2 years of experience at my first full time job at an early stage Startup working as a backend engineer. I have strong data structures and algorithms fundamentals, and had the chance to work on Procurement Solutions involving scalable real time auction system. This experience has given me confidence to tackle complex problems with ease.
Location: Amsterdam (Europe, CET timezone); at the moment.

Remote:Yes

Willing to relocate: Yes

Technologies: R, Wordpress, GraphPad, open to learn new technologies.

Résumé/CV: upon request

Email:wieke95@gmail.com

I am a woman who is a beta person and learns technical skills quickly. I have studied biomedical sciences and neurosciences. I like to become better in machine learning and increase level of programming.
Location: France, CEST timezone (UTC +2)
Remote: Yes
Willing to relocate: No
Technologies: Python, CUDA, pytorch/JAX/TF, Aws/Docker/Linux, typescript/React
Résumé/CV: https://morgangiraud.com/public/cv-morgan-giraud.pdf
Email: contact[AT]morgangiraud[DOT]com

I'm really passionate about ML, both in terms of research and production. I've also founded (as the tech) a startup which operated successfully ~10 years. I'm efficient at understanding product and user experience requirements and distill them into actionable technology, as well as interpreting research papers to enhance models in production.
Hyper static global environment (forth)
I mean, it's one banana. What could it cost? Ten Dollars?
Because the project would be a failure otherwise, and including those is the main goal of the project.
Drinks mixer! Line up the booze bottles and other stuff.

No need for brute strength. Tolerances of one or two millimeters are mostly fine.
I like their selling point and if there is enough demand, I think the node community will implement at least a few of those features.
> the only hope is to try to figure out how to solve them.

Or to find alternative ways of doing things that aren't bottle-necked on pesky physics. Who needs really expensive methane? Natural gas is only convenient when it's cheap. When it's not, other means of creating heat are available. The whole premise of synthetic gas is that we don't have to change and it will be great.

The reality is that this isn't all that great. Even at the cited prices it would be an order of magnitude more expensive than what people pay for their gas currently. And I would take those optimistic estimates with a huge grain of salt.
They removed the repo so only the attackers had access to the code and know how.
I think you give too much agency to 4chan. It's just a imageboard - an internet forum - that happened to have some subforums related to alt-right. Maybe it had (has) a bad influence on people, but it's hundred times smaller than Facebook, Twitter or Reddit. To say it has single handedly started a movement is a huge stretch.
But you can sneak in reviewed (by you) changes, if you have control over the repository.

Again: both the Git and the tarballs are released by the same developers.
Points for Collin for letting his holiday take precedence over this mess.

Don’t forget that he made xz for free, as a hobby project, and likely got duped by “Jia Tan” same as everybody else did. He’s not obligated to solve this on any particular timeline.

Xz is not a business, so if your business got in trouble because a single solo hobby dev was a bit too trustful, it’s your job, and not his, to mitigate the problem.
I can see his point: deleted code is really hard to discover. You can fetch it if you know it's there, but how do you find it in the 1st place?

With that being said, commented code is rarely useful and it cna be a liability indeed.
I’m not debating here fictional solutions to how urban areas are being built.

I’m just stating the fact that due to a still very much accelerating population explosion until 2100 combined with a decrease of habitable space it will inevitably create a huge (further) boom in house prices. Wether we start accommodating people in shoe boxes or McMansions has little impact on what I am saying, because the point is, if you buy a nice property today then it will go up in value because there will be market pressure and anyone who will be able to afford a nice home will outbid each other in the free market for the stock of nice housing which we have.
The Disarray Inside Boeing's 737 Factory Before the Door Plug Blowout