skysight-inc/HackerNews huggingface dataset:
tbf, most security issues aren't from some insider, but outsiders discovering exploits. The insider scenario here is extremely rare both in commercial and FOSS software.

Corporate insiders do stuff like this too, its just how often do we hear about it? FOSS has high visibility but closed source doesn't. Think of all the shady backdoors out there. Or what Snowden and others revealed.

On average a 100% FOSS organization is going to be much, much more secure than a 100% commercial close source one. Think of all the effort it takes to moderately secure a Windows/closed source stack environment. Its an entire massive industry! Crowdstrike alone has a $76bn marketcap and that's just one AV vendor!

Commercial software obeys the dictates of modern capitalism. Projects get rushed, code review and security take a backseat to quarterly reports and launch dates, etc. This makes closed source security issues common.

Usually when the exploit is discovered the attacker is far outside the victim's jurisdiction. See all the crypto gangs operating from non-Western non-extradition states.
The XZ Utils Backdoor: FOSS Delivered on Its Pitfalls and Strengths
For example ?

[1] lists [2] which uses a robotic arm, but it is closed source

[1] https://github.com/360er0/awesome-lego-machine-learning
[2] https://www.thirdarmrobotics.com/q_and_a.html
Timeline reads like a "pig butchering" or romance scam. Except the goal is not money, but control.

Attackers find a vulnerable but critical library in the supply chain. Do a cross check on maintainers or owners of the code (reference social media and other sources to get more information). Execute social engineering attack. Talk to maintainer(s) "off list" to gain rapport. Submit a few non-consequential patches that are easy to grep to gain trust. Use history of repository or mailing list against victim to gaslight ("last release was X years ago!1", "you are letting project rOt!", "community is waiting for you!").
Almost legit article (has little to say) but boy that is a spammy headline with multiple repeated keywords and phrases ("best printer" x 2), ("print..." x 4), ("use" x 2), etc. For "office use" you probably are willing to pay a little more and there are more good choices such as Xerox Workcentre printers.

I also disagree with the hating on inkjets. I agree a B&W laser is a good choice for most people but I have a hobby of printing photographs, art reproduction, anime art and such:

https://mastodon.social/@UP8/110607498804590869

and I think the quality of results you can get is astonishing if you use quality materials and I don't complain about the cost (low in my case because I use a tank printer) because it sure would cost most to make one-off prints any other way. (If I wanted 10,000 prints I could make offset litho plates, it would be cheaper, and I'd have a great selection of high-performance inks, but I don't want that many)
It's not weight, it's BMI. If you shift your composition to muscle without changing your weight, that's still a dramatic improvement. This is not "a complex." Discussions of "losing weight" are typically short hand for reducing the percentage composition of fat in the body.

If you're obese, changing composition will likely add many health benefits, and very often the overall weight of the person shifting said composition will be lower because they were carrying a lot of fat, and only added a reasonable amount of muscle if they took up exercise.
> All good? Well, if you trust Github!

And if you trust that your secret ssh keys don't get hacked away from your machine, giving someone else the rights to push a tag and automatically make a release on pypi.
I've been shipping software, my entire adult life. It's what I do.

My stuff tends to be pretty good. Sometimes, I give exactly what was asked for, which might not be so good, but what I make, works; even if rather ugly.

If I'm allowed to work iteratively, with a good creative, we can make something very good.

I don't usually come up with uniquely original ideas, myself, but I'm really good at turning vague ideas into reality. I Make Stuff Happen. I've been doing that, since I was in my early 20s.

What I have encountered, is that folks put no value, whatsoever on that ability. Like, to the point of being downright insulting. They don't like the cold wash of reality, bringing their lofty ideals into the world of the achievable. I've been told that I'm a "negative naysayer," but nothing could be farther from the truth. I want the thing to happen, and recognize the hurdles that need to be vaulted.

When I was younger, and part of much larger organizations, I had to eat the disrespect poo.

Nowadays, not so much. I guess folks think I'm a cranky old prima donna, but I won't accept being treated like crap. I'm quite aware of the sheer value of what I can do.
> console ... messages are considered to be for debugging purposes and therefore not suitable to ship to the client.

Hmm. This strikes me as a non-sequitur.

One may very much want to ship debug messages to a "client" (end user).
How would this have made it into Debian? Part of the Debian build is to pull down a release tarball (and then build from source) and not `git clone` a repo at a specific tag and build from source?
SWE-Agent
https://github.com/adamb314/ServoProject

^Modifying cheap servos so that a robot arm can repeatedly insert a pencil lead. It's a lot of work though.

Most interesting application though fall out of the scope of old-fashioned robotic arms, i.e. when you need to sense the real world in a non controlled context. For instance to develop a robot that can trim wilted flowers, you'll need to measure the real world, and as soon as you do that, you can just sense your robot arm too, no need for fancy, ultra-precise actuators.

Look at this BOM: https://docs.google.com/document/d/1_3yhWjodSNNYlpxkRCPIlvIA...

Do you really need the $6,129.95 & $3,549.95 robot arms for the kind of application described ? I doubt it. I'm not a robotician, and would love some feeback on this idea.
Sorry, but that is not fair or even normal. Are you saying that anybody can do something new only if they _can_ handle all the externalities that they cannot possibly have control over?

Lets say you develop a new, better calendar tool that makes secretaries/personal assistants redundant. Are you supposed to release it and make money off it only if you could find a way to employ all those personal secreataries and assistants in the world?

I do agree with you and hate the trope that is "we make the world a better place" or using the word - sustainable and green color to things that cannot possibly be either.

If a politician says "go get a job, don't leach off the government and tax payers" and is so out of context, may be the political system and electing such a politician is a problem, and you ought to improve the society than asking Microsoft to think about the jobless...
Unfortunate, for professional labor you pay double.

But modern houses just plan those in anyway and the battery storage i'm aware of, they are only 10kWh which costs not that much anyway.
I had no idea ytmnd still existed

Another point for old web longevity
Yep the math does work out. Take the 27 million and start filtering:

- is in your country

- has an engineering degree

- understands pointers

- has worked in Faang and/or serious startups

- is someone you can trust

- has business acumen

- is in a family position to do a start up

The choices drop off pretty fast.
For the mature audience... the Lock Picking Lawyer did a great one this year https://www.youtube.com/watch?v=7X2PuE6ELmg

I thought Open Asteroid Impact was pretty insightful.
https://openasteroidimpact.org/
Thanks, this is the pointer I was waiting for!
Is interactive mode the value-ad over ripgrep and ripgrep-all?

I accomplish similar with ripgrep and fzf.
Revolutionizing Art: Christie's and Proto Hologram's Cutting-Edge Collaboration
They made a pretty funny movie about this in 2009.

https://www.imdb.com/title/tt1131729/

Starring the very funny Katherine Parkinson and Chris O'Dowd of "The IT Crowd" fame.
Conversely, older workers don't really care about what has business value and what doesn't, and if they did, they certainly care less about getting entangled in a discussion about it.

I know a lot of older workers, myself included, who don't want a seat at that table anymore.
Good idea. Built https://srv.us/d that does (edited):

<html><body><script>document.body.innerHTML = decodeURI(window.location.hash.substring(1))</script></body></html>

So you can point to https://srv.us/d#<h1>Demo</h1>
Almost free availability of weapons in the USA is a case in point that this assumption is not true.

There maybe good reasons to have open models but pretending that systems that allow an individual to project power beyond their immediate vicinity is harmless is naive.

An individual with a weapon can almost always cause carnage at a level greater than their own with before any first responder can deal with it. Be that a viral video of someone faked to be blaspheming or somebody with a weapon in a school. Once the shooting starts it takes phenomenal energy to put the problem back in the box.
If you are interested in the source (and can read 6502 assembler):

http://www.6502.org/source/games/uchess/uchess.htm
I think the level of complexity is the problem. A bad actor can be embedded in any of the above contexts: corp, non-profit, FOSS hobbyist. It doesn’t matter. The question is: when software is so complex that no one knows what 99.9% of the code in their own stack, on their own machine, does (which is the truth for everyone here including me), how do you detect ‘bad action’?
Just switch YouTubers and Instagram models for bloggers. His point is that everything is advertising
It's strange that our website is being blocked by an ISP.

Could you please provide us with the name of the ISP so that we can contact them and request to have the ban lifted?
Not the commenter you replied to, but I noticed that it depends on Redis and Mongo, which are proprietary database products. However, there are Redis and Mongo mostly-compatible DBs that are Open Source, so you can probably swap them in (though the project may not officially support them and test with them, so you may have to be willing to contribute testing and bug fixes yourself).
You’re right. I can’t edit that comment anymore, but this link should be fixed:

https://archive.is/7kHer
The chase to capture consciousness can't really end in anything better than a false reproduction. Similar to a Hollywood film being a false representation of a fantastical real life event.

The next scientist inspired by this chase, will flesh out the Epicurean claim "the soul dies with the body". He will find out exactly when and where consciousness dies with the body. And the next Dante will condemn him to Hell for it.

The way some men's eyes light up when they dream of understanding and capturing the soul, rings alarm bells. Wanting something you can't have is dangerous.
> but is significantly more misuse and compromise resistant

I don't think it is at all.

Without it, I have a supersecret token.txt file on my machine.

With it, I have a supersecret .ssh/ directory, which grants access to do a git tag, which will publish without needing to know the pypi secrets at all.

You just moved the secret into another file.

Am I wrong? Can you explain how am I wrong if you think so?
Most of what I know in these areas is either something I can't talk about, or is surmise based on conversations between others when I was around. There's a lot to do with the laws of physics, but equally, many times people have found clever things to do with the data they have.

I wouldn't care to speculate further, but you might want to read about phased array antennas, and FMCW radar. There are some very deep rabbit holes here, and I certainly would not be your best guide.
I'd suggest reading the book Creative Selection by Ken Kocienda, which makes it clear that this wasn't the case.
Show HN: Lockbook, a secure and open note taking platform [video]
Hey HN,

Along with a handful of friends, I've been working on a note taking platform for the last couple years. We created a 2 minute pitch of our platform, if you'd prefer to read, maybe you'd want to checkout our README: https://github.com/lockbook/lockbook. If you don't want to do either of those things I'll try to summarize some of our core values:

- everything end to end encrypted

- open formats: markdown and svg

- strong offline support

- everything open source

- native apps where possible

- rust where possible

Some other stuff we're proud of:

- we have a CLI which lets people edit using their favorite text editor: https://blog.lockbook.net/cp/137878891 we're also experimenting with a mounted file system where a CLI falls short (checkout `lockbook fs`).

- we built a markdown editor in egui that fit our needs and embedded it within several of our (native non-egui) clients: https://blog.lockbook.net/cp/136569994

At the moment we have 3 goals:

- grow the community of early adopters who like what we're doing and are interested in giving us continuous feedback as they try to adopt the app.

- find like minded engineers who are looking for open source projects to contribute to.

- increase the stability of the platform

Thanks for your attention ♥.
This shouldn't be a surprise to any of us here on news.ycombinator.com.
Bernie Madoff was a fraud, which is an unrelated thing to this convo

Palantir is a real company. "I am sure Palantir has a bit more but not by much". Why are you so sure?
I could see people wanting to add on color detection for the bricks, but even that could still be solved by camera + servos/steppers and a chute that goes to different bins. No need for an arm.

Doesn't stop me from wanting one though.
Yes it seems a lot like a case of a predator picking off a weak and sick individual.
Dropping 10lbs reduces weight on joints by 40 lbs. This can contribute towards feeling better
Can I suggest you look at the FODMAP "diet". Go on the elimination phase to remove the potential FODMAP triggers, then if and when it gets better after a few weeks start re-introduction to see what the triggers are. For me its Garlic, Onion, Fructans in Soda drinks and most fruit.

After sorting that out I added some psyllium fibre tablets and I'm mostly sorted.
What organizations have a no open source policy? They would be hard pressed to find any significant commercial software that doesn't have an open source dependency somewhere it its dependency chain!
Location: Lithuania, Vilnius
Remote: yes
Willing to relocate: no
Technologies: 6+ years of PHP, Symfony mainly, willing to adapt to or change technology. + Docker, linux(ubuntu), SQL, REST API design, etc.
Résumé/CV: https://www.linkedin.com/in/rokas-lakstauskas/
Email: rokas.lakstauskas@gmail.com

Would be interested in fulltime jobs.
https://catchthatdruid.ytmnd.com
Does it work with android auto?
Just as everyone else did in the 80s. Judge people by the times they lived in, for you will be judged the same.

(Without a doubt, something you think is OK, and everyone else does, will be seen as a horrible monstrosity by your descendants. It won't be something you can think of, and yet you'll be judged for it as a monster by some.)
I have zero idea what I am going to use this for, but the idea of having a robot arm has fascinated me since I was a kid and I am 100% going to start working on this this weekend.

I think I could find some fun projects. I wonder if it could hold my microphone and it turn into an automatic microphone arm...
Does your cheat day involve processed carbs or whole grains?
I'd really like to see an application level VPN that plays well with Go to `Dial` a `net.Conn` or `Listen` for a `net.Listener` in my Go application.
I think that is intentional and that the goal would have been achieved even if Jigar (who probably is the same guy as Jia) had been banned.
The docker compose file has clickhouse and postgres.
The folks downvoting you would do well to listen to the recent _Behind the Bastards_ series about Steve Jobs.
I've tried to square the racial-justice-amorality of the "someone fck sht up, I don't care who" crowd with the racist sources of many of their grievances (as someone who can't afford such extravagant feelings). The roots of so many of our issues with abuse of the downtrodden, the impunity of the elite, the distrust of populist-minded institutions, the misplaced trust in monsters who whisper sweet words, etc., come from our history of racialized classism.

I don't know how you convey to such people how these problems don't get solved without rectifying the racist underpinnings - that "that's not okay" only gets teeth when "that's okay because it only happens to 'those' people" is no longer accepted. Only then do you see a substantial decrease in face-eating leopards.
AI-powered regular expression generator
I and my core group of friends spends well over a thousand dollars with Discord each year for our server boosts and their nitro accounts all because we wanted a premium, no-ads experience for our private community. If a server owner doesn’t want this, they should be able to opt out. Discord can kill the golden goose if they aren’t careful.
> This event should be a wake-up call to businesses everywhere

This ought to be not only a wake-up call for businesses, but also to hobbyists and members of the public in general; our code, our projects and our social "code-generating systems" must be hardened or face rampant abuse and ultimately be weaponised against us.

In a way, these issues which FOSS is facing and are becoming apparent are no different to those democracy been submitted since time immemorial.
What do you think of WebAssembly modules? It looks to me like the shared memory support that came with the threading proposal (which seems somewhat widely supported) should allow libraries to be isolated in their own modules and exchange data through explicitly shared memory even if they run on the same thread.

With secure isolation being a requirement for web browsers, and with the backing of multiple big companies, it seems like there should be enough momentum to make it work properly. Or maybe the browsers rely entirely on process isolation between different origins and won't care about the security of isolating individual modules?
The Jia Tan character was never rude. If you make rudeness the thing that throws a red flag, then ‘nice’ fake accounts will bubble up to do the pressuring.
Implementing a 2d-Tree in Clojure
What I learned implementing a 2d tree in Clojure (and its implementation)..
This is not Lasse Collin’s responsibility. What is a burnt out committer supposed to do? Absolutely nothing would be fine. Doing exactly what Lasse Collin did and turn over partial control of the project to an apparently helpful contributor with apparent community support is also perfectly reasonable.
I think most of the business problems are solved with a generic app/site.

The problem is that the non-technical founder doesn't have the funds to hire senior developers so he needs to raise money without being able to present a team and alpha version.
Also, if there is no buy-in from tech-people, how well are you going to do when that senior developer gets a better offer some months down the line from a different company?

I dunno how well investors value that proposition?
> Most of the researchers are specifically in a handful of big labs, most of which in turn are in the USA.

Looking at https://paperswithcode.com/greatest a lot of the papers come from US labs - but there are also quite a few that come from Chinese labs.

And consider the case when an influential paper comes out of a Microsoft research lab with the authors He, Zhang, Ren and Sun; obviously you can't guess someone's nationality just from their name - but I think it's naive to think the US has any sort of guaranteed monopoly on ML.

Especially if the US decided to send the message that ML research isn't welcome.
You may want to read Kevin Mitnick on how (relatively) easy it is to infiltrate physical spaces.
ZITADEL would be a good choice if you have multiple tenants and want delegate things like access management and configuring auth per tenant in self-service - that part comes out of the box with ZITADEL and could save you quite some development. I wanted to throw that in, because for the authentication part most solutions would match your requirements, but keep also authorization and auditability in mind.

That being said with ZITADEL you can also move between self-hosted and cloud: https://zitadel.com/docs/guides/migrate/sources/zitadel

ps: I'm biased (see bio).
https://academic.oup.com/brain/article/141/3/e20/4850980?log...
You have a great list, but as a potential (and very reluctant) technical co-founder candidate, i'll two more major items to the list:

3. UPFRONT RISK: If you are doing this with sweat equity (no salary) then the Technical Co-Founder is taking almost all the risk. They are putting in all the time upfront, before the Business Co-Founder does. Smart Business Co-Founder would sell the idea to potential customers also, or get POs, or raise funding to pay for the technical effort, or invest their own $ to pay for the technical effort. However, a situation where one co founder (technical) puts in all the effort while the other gets a free option to put in effort later, is a very bad setup.

4. LEVERAGE: The Business Co-Founder essentially gets more leverage the more work the Technical Co-Founder does -- because now there is sunk-cost and a psychological shackle. The Technical Co-Founder just wants to be done with the build-out so the business can proceed and make money -- but the Business Co-Founder has every incentive to expand the MVP more and more since they are putting in no effort (possibly have not quit their job either) and wants more and more before the system can be sold.

ADVISE TO POTENTIAL TECHNICAL CO-FOUNDERS

- You be the "Business Co-Founder" also, no need for another person

- If there is a Business Co-Founder, equal out the contribution at every stage. A PRD is not enough to equal out a build-out. Some ways to equal out the contributions:

- Business Co-Founder has proven record that attracts success guaranteed (e.g., prior major exits, IPOs, huge online following, extreme case would be Elon -- i'll be a technical co-founder for him any day :-)

- Business Co-Founder sells concept to clients, gets Purchase Orders before build-out

- Business Co-Founder gets huge list of potential customers, ideally with pre-orders

- Business Co-Founder raises funding and pays technical co-founder for upfront effort

- Business Co-Founder puts down their own money (or takes a loan) to pay Technical Co-Founder for upfront build
pretty unhealthy attitude to live by tbh. almost better being burned by a malicious payload once every 10 years than live in perpetual fear of being constantly scammed
In Robotic assisted surgery, Tracking targets are mounted on the robot arm and an infrared camera tracks the exact position.
What value would you put on marketing and selling the product? I always assumed that is what the non-technical founder would take care of.

Ideas are important. Building a product is important. Both achieve nothing unless you can actually sell what you have built.
The press release is from Stanford itself. Why would they (Stanford Medicine) fail to factor in correlation/causation?
Yawho?

I really thought Yahoo! was just a brand now, like Nokia.

> more than 185 million people come to Yahoo News every month
Why not just throw a SteamVR/Vive laser tracker onto the end of the arm and use that to close the loop? They claim sub-mm precision at room-sized distances, so it should be even better if you had it basically mounted on the base. If you wanted to get fancier you could build it into the end effector w/ one of these?
https://tundra-labs.com/products/tl448k6d-vr-system-in-packa...