skysight-inc/HackerNews huggingface dataset:
AI Winter was related to neural networks existing but computers not being fast enough to handle the amount of data needed to train them + massive datasets themselves not existing.

So far, I'd say no? New models are still being developed and getting better in very short time frames vs what folks did historically.

The finance bubble thesis is more related to: "are companies going to generate revenues to justify the massive investments being done?"
Hmm, so anyone can just start a company with the name of an open source project and try to monetise it? Like someone could start e.g. "Rust Labs" and sell a commercial version of Rust?

I don't know much about the genesis of Redis or Redis Labs, who key people and dates are, etc. I guess this obfuscation is part of the problem.
Watch any top tennis game and unforced errors and %age first serves often tells the story of the match
Hey, you should put a trigger-warning on that
“ Funny how choosing a side project casually turns into existential crisis.”

It’s the paradox of choice. Sometimes we just need to turn off our brains and simply do.
The build script decoded a precompiled backdoor code from a binary test file that wasn't really an archive, but encrypted with Caesar cipher. Any blob can be used like this as a trivial steganographic contained.
I held a number of low-paid jobs while in high school and college. I can't say that dealing with cooking grease was enjoyable, but in no case can I say that the working conditions were abusive.
Metrics will go up, hooray!
That is absurd. LGPL is widely understood. Compliance is generally pretty easy. The Linux kernel has many users, and it is GPL.
> killed [...] die or go to jail

All of my commits are signed with a PGP key that is on hardware security tokens and password-protected. In the event of my death, my digital identity could not be stolen without backdoors in my hardware security tokens.

That being said, $5 wrenches and large sums of money are still possible attack vectors.
Hi,

I'm the author of such PR. My purpose was to trim down the size of the initram files by removing unneeded dependencies.

I couldn't imagine that liblzma had a backdoor.
I know 3 m waves are powerful, I was within them.

But they are normal on most coast and that they are bad on a flat beach I can imagine. But Taiwan is quite steep, so aside from some damaged boathouses, I cannot see the big danger (compared to the consequences of the earth quake). But apparently no Tsunami came.
This seems rather incomplete. Even if you were to use the cheat sheet to create a role/user and create a policy with a condition there's zero mention of row-level security, or even the 'ENABLE ROW LEVEL SECURITY' statement which is a requirement for any of this to even work. There's no mention on differences between 'USING' and 'WITH CHECK' on a policy and it seems to give off the idea that users and roles are separate things.
Heads up, I believe you are legally required to provide a pay range for your NYC job listing. See https://www.nyc.gov/site/cchr/media/pay-transparency.page for more.
Any code that extract data from such a blob would look very suspicious.
What's malicious about that patch? From reading the thread it looks like an attempt to fix a FP from some tooling.
If you want security, pay for independent code audits (not compliance bullshit). Repeatedly. Don't offload your desires onto one-man-shows that the world decided are useful tools.
It's been hugged to death perhaps. The site is also hosted on github here:

https://osj1961.github.io/giam/
I agree that we have to reduce the carbon emissions. I am wondering, though, if we started at the right place.

More electrical demands will further cause building new power plants, but none of them come without another, different impact. Sacrificing fields for solar power, flooding valleys for hydro, cutting trees for better wind, etc. I have seen it done and it makes little sense. Maybe these "local" changes will have other impacts we do not know about.

On the other hand, decreasing meat consumption might also help significantly but there have only been half-hearted attempts at it. Farmers and people will hear none of it.
Valkey has the support of various Redis developers who moved over, keeps the same license as the original Redis did, and stayed on GitHub to keep the workflow that Redis developers and contributors are used to, so I expect it'll end up winning out.

GitHub is proprietary and not ideal, but when trying to get developers on board after a fork, using GitHub and using the same license as the original avoids spending innovation tokens / weirdness budget unnecessarily.
Why would I or anyone else care what the tech review community has to say about anything?

What kind of idiot wants technological advances held back so they don’t get disappointed and the market doesn’t get disrupted?
I took a look at the diff linked in the article with code that "we are all running". The top of the diff certainly looks interesting. They remove the bounds check in dict_put() and add a safe version dict_put_safe().

This kind of change is difficult to make without mistakes because it silently changes the assumptions made when code calling dict_put() was originally written. ALL call sites would need to be audited to ensure they are not overflowing the dictionary size.

The diff I am referring to is here:

https://git.tukaani.org/?p=xz.git;a=commitdiff;h=de5c5e41764...
XPC Resources
Even a few percentage points extra would be a big positive to society, since presumably the teenagers will learn real world lessons at a faster rate than padding out college applications.
Backdoor relied more on compromising supply chain than on particular glibc feature. And the fact the notify support in sshd wasn't implemented directly but via libsystemd that is the one that dragged the lzma dependency into SSH
> If you aren't a cloud provider and you don't modify the code of your chosen Redis variant,

Or get hosted redis services from someone other than Redis Labs. That isn't fearmongering about the SSPL, it is literally the point of the SSPL.
You seem to know your stuff, perhaps you could suggest some direction for an offhand idea I had? I'd like to build a standalone version of something like this site for an art installation at a festival a friend is hosting. I was thinking of having an analog phone plugged into a USB modem in a Raspberry Pi that doesn't even produce a dial tone when you pick it up the handset. It'd just go directly into a voicemail prompt. I assume there's a software stack which could accomodate this but I know basically nothing of telephony.

Any suitable projects come to mind which might facilitate this?
What if over 80% of all open source projects are secretly sleeper agents for various malicious actors, states, terrorists and whatnot, and they pretend to give use precious software updates for free so they can attack later?

What if proprietary software is running the same way, except they don't even give you free updates and you can't audit the source code and have to trust them when they push updates?

What if your mother gave birth to you just so she can slap you in the face when you're 30?

Yeah, we can go very far, but in this moment, xz is under so much scrutiny that in 2-4 weeks, I'd trust it with my life unless the big orgs looking at it issue more reverts (hence, the delay). So if there are issues, they're everywhere else.
> To be honest, it's far above my knowledge

Just means it's an even better opportunity to learn!
IIRC sshd loads libpam only if specifically configured for it. So while it's not wrong, it's also a more edge case for the backdoor to work.
Very good read. However, the chess example about the Tata Steel tournament is incorrect.

The prediction chart shown was not based on guesses from grandmasters. It was simply the implied probability of each player winning based on their relative Elo ratings, their current tournament standing, and upcoming pairings.

Essentially it was a Monte Carlo simulation of the tournament, which was updated after each round by the author on reddit.

Doesn’t impact the validity and strength of this article, but just wanted to point that out.
> If insurance company is forced to repay the whole cost of the rebuild, estimated it will cost lets say $600M. Tax payer is happy they're not paying via Federal taxes. But, shipping and logistics insurance companies start to ramp up their premiums and those fees are passed on to, eventually, the consumer over the long term, this could end up costing the tax payer more ?

Isn't this the point of insurance and specifically underwriters - that they aggregate the possible outcomes over a huge set of assets, with the expectation that sometimes they will have to pay out if an accident or whatever happens?

There should be no increase in anyone's premium. Though, from a marketing perspective, given the level of publicity that this event has gotten, perhaps people are primed for a raise - and this is a good time to do it!

Honestly, "insurance" sounds like an ideal area for a headless company. Its really only providing an aggregation of certain risks, so no individual company person is wiped out. The more assets it manages, the less risk they have, and the more the price of the insurance should drop.
Show HN: I made a real time Talking Teacher for your textbooks powered by AI
I made an AI that can take your boring textbook pdf and convert it into an AI powered tutoring session.

The AI Tutor session is like a voice conversation you are having with your tutor. The tutor will speak to you explaining the concepts. The tutor will also ask you questions to test your understanding and you can also ask the tutor things you did not understand.

Try it out at auditutor.com for free
Ever thought about ... let's say you were God. You wanted to design intelligence, to control insects, animal bodies and eventually humans. What would it need to do?

Well, you'll quickly find that bodies require constant control to survive. Whilst an animal's body can survive for months with an animal's mind operating at 1% capacity, if the output of the mind truly stops, the body dies. The heart, respiration, the circulatory system (deciding where the blood goes), ... all need to be controlled with some amount of intelligence for them to function at all. Even just to remain alive, they need intelligence. They don't work on reflexes alone.

For mammals, total loss of control leads to fatal injury ... in seconds. Without control, the heart will either stop or (wrong order of muscle firing) be totally ineffective at building pressure in the circulatory system. This will kill oxygen transfer through the blood-brain barrier as soon as the pressure drop reaches the brain, which will be much less than a second, this leads to further loss of control in 2-3 seconds. Irreperable damage sets in before 20 seconds pass, death (permanent and total loss of control) occurs in humans after about 1 minute 30 seconds. The plus side of this seems to be that, when that control is there, mammal bodies are far more efficient than a "passive" robot can be (any robot you can turn off -safely- at any time is a "passive" robot, the big counterexample is a flying drone, which will incur damage and may injure others if turned off or it loses control)

So "predict the next token" is really THE most important function of the brain. Second, it is incredibly important to KEEP predicting the next token, to keep going, and keep going, and keep going, no matter how stupid the output, because literally any output will give a result superior to no output at all. No matter the damage, no matter how terribly wrong things are going, it must keep going further.
Neumann completed an undergraduate degree in just 15 years. He is a college graduate. Do not understimate his abilities.
Location: Moscow, Russia

Remote: Yes

Willing to relocate: Yes

Technologies: Node.js, Nest js, Typescript, JavaScript, React, K8S, PHP, Symfony, PostgreSQL, MySQL, Golang, Management

Résumé/CV: https://www.linkedin.com/in/xardas

Email: thexardas@gmail.com

I am a manager and engineer with 15+ years of experience, mostly in development of web and single-page applications.

Solid skills in System Design, Architecture, building development pipeline, hiring and organizing teams of various specialists.
The attacker had access to the GH mirror of the repo. The original repo remained at https://git.tukaani.org/
I feel like the first step would be looking at the antenna since you’re using a weird antenna connection to a different buildint
If all wages rise, than inflations rises along with it… to cancel out the wage rises in practice (unless productivity improves). As the last few years have shown.
In German, it is not and never was ambiguous, so it is not a mistranslation. What the meaning of "Whole number" in English is, is not really relevant, except for explaining the mistake in the book.
You can create pairs of SHA-1 hash collission, but not for a particular existing SHA-1 hash (the git one)
Agreed, as a developer: minimize your dependencies while providing your core function. Don't grant dependencies permissions they don't need. Be granular about it. Austral lets you select what filesystem, network, etc. access each library gets.

Also, in big organizations, risk assessment is more about making sure there is someone to point the finger at, than actual security. Treating libfubar as golden because it ships with something you paid another company money for makes sense in that light. But not from an actual security mindset.
Hi! Was there any discussion on any mailing lists ahead of time, or was your PR the first public mention of that idea? Thanks.
I can't believe people aren't using devcontainers
SD cards would be nice. Opus at 128 kbps is perfectly listenable (transparent for me) and 9 times smaller than PCM audio, so if you only need PC compatibility, you can burn data disks full of Opus.
VictoriaMetrics CTO here.

The referred library is the official OpenTelemetry package for reading metrics in Go language [1] - more details are available at [2].

Note that we at VictoriaMetrics like the idea of unified observability standard like OpenTelemetry. The issue is in the current otel implementation. It is too bloated and very inefficient. This contradicts our experience with observability cases, which need optimized yet easy to debug format for metrics' transfer in order to reduce costs on CPU and network traffic needed to transfer and process these metrics.

VictoriaMetrics continues investing in OpenTelemetry by providing integration docs [3] and improving the existing functionality for otel metrics' ingestion [4].

[1] https://github.com/open-telemetry/opentelemetry-proto-go

[2] https://github.com/VictoriaMetrics/VictoriaMetrics/pull/2570...

[3] https://docs.victoriametrics.com/guides/getting-started-with...

[4] https://github.com/VictoriaMetrics/VictoriaMetrics/issues/60...
> Like someone could start e.g. "Rust Labs" and sell a commercial version of Rust?

No, because the Rust trademark guidelines prohibit that (https://foundation.rust-lang.org/policies/logo-policy-and-me...)

In Redis Labs case, they acquired the Redis trademark from the original author, who they employed for a few years after the project was well established.
You also need to have sshd enabled to use PAM and your sshd pam stack should include pam_selinux. Then it will be dynamically loaded only when sshd starts a PAM session.
Again you have to specify specific timelines, otherwise it would be an infinite number of potential futures, with an infinite responsibility in the abstract.
Open source seems to be doing fine without the clarity. Even fields that have nothing to do with software are adopting the mindset. The movement only gains in steam
https://archive.is/e9kFC
reminds me: https://www.youtube.com/watch?v=spLA3bpAfyI
Adding some unreadable binary to the source code is a really dangerous thing to do.
We also need tools to quickly detect the addition of indentation symbols that can be easily overlooked.

BYW,I had a classmate who used to play DOTA1(on war3) under this name at the University of Science and Technology of China a long time ago, and this was his first girlfriend name (maybe) . His father was a high-ranking official. Then he joined the parent department of the Internal Security Detachment, a secret service that has gained a lot of power in the last few years. I hope I'm not awake . lol.
Within a given part of an organization, just about everyone thinks they're underresourced and understaffed.
I've been making my own cappuccino's for the past decades and always laugh at the prices I see the rare times I take one while out. Buying my expensive machine has practically been an investment at this point... lol

It's clear that going out for anything in the past years has become not only a luxury but a head scratcher most times.

Invest in your setup and skills - not only will you save in the long run - you will learn things and have fun doing it.
> Was the backdoor used on obscure build servers or obscure pieces of build infrastructure somewhere?

And developer machines. The backdoor was live for ~1 month on testing releases of Debian and Fedora, which are likely to be used by developers. Their computers can be scraped for passwords, access keys and API credentials for the next attack.
"For another thing, if the light came from incandescence, what on earth was a pulsar? Surely a star couldn’t be alternately collapsing and un-collapsing."

This is odd, as pulsars were not discovered until 1967, and not hypothesized prior to their discovery.

Variable stars have been known to science of since 1638, and an explanation for one type, eclipsing binaries, had been established by 1784.
I agree in principle, I pay for many services and products that have workable free alternatives, but Discord is double dipping (with tracking, and ads in the future) like most companies.

I'm fine with "Pay to use our service, privately", but with these corporate products it's usually "Free with tracking and ads" vs. "Paid with tracking (and ads after a few years)", which I think is a disrespectful business model.
> The other thing that can't happen is accidentally adding the folder to version control.

A few other ways I've seen embedded venvs interfering, off the top of my head:

* Polluting output from tools like `find`, `grep` and `tree` (yes, some have .gitignore options, but you have to remember to use them and some don't have the option at all, and often that's not appropriate anyway),

* Increasing docker build times due to not adding it to .dockerignore,

* Ending up in source packages somehow (e.g. serverless framework).
Snapdragon X Elite PCs better be bangers
> I found the Marxist!

Ahah, Marxist I am for sure :)

> Revolution and then what?

The end of the totalitarian bourgeois dictatorship, and the birth of a workers democracy. Considering most of the western world is industrialised already, we wouldn't have to tolerate first a "managed" capitalistic economic mode of production (like china has to), but directly switch to the socialist mode of production, so, for laymen, workplace democracy.

Or if you will, a path to real freedom, at last.
There is an analogous situation in (e.g. sports) betting. Every now and then someone places a really long bet on something like Leicester winning the Premiership and then gets a collosal payout. Inevitably there's some naive speculation that the betting shop will be very unhappy with this. In reality theae u likely events happen relatively infrequently (often disproportionately to even their long odds) and the publicity from such an unlikely win more than makes up for the payout.
Wireless sensors, synthetic aperatire radar, aerial surveillance all are things that exist. These things have existed since Vietnam and are significantly better now than they were then. The record for Lorawan sensor mad range was ~1,300 km / 830ish miles. You could partition the rainforest into grids and use these sorts of sensors if you wanted to be excessively thorough. Not easy or cheap, but very doable with today’s technology and a bit of customization.

Note: my grandfather invented some of the rf sensor technology designed to be airdropped by the US military over the forests of Vietnam for this exact thing. It worked well for what it was designed for.
It’s made up.

:)
Understanding Linear Feedback Shift Registers in FPGAs
> The way forward is to invest heavily in a much more security-oriented kernel(s)

While I don't disagree that kernels should be secure, I also don't see how that would have helped in this case, given that (AFAICT) this attack didn't rely on any kernel vulnerabilities..
I think the RedHat Valgrind report on 2024-03-04 made the Jia Tan team panic, since the one public rwmj stack trace pointed the finger directly at the backdoor. All it would take is someone looking closely at that failure to expose the whole operation. They fixed it on 2024-03-09, but then two weeks later distros still had not updated to the new version, and every day is another day that someone might hit the Valgrind failure and dig. I think that's why the sockpuppets came back on 2024-03-25 begging Debian to update. And then on the Debian thread there was pushback because they weren't the maintainer (except probably they were), so once Debian was updated, Jia Tan had to be the account that asked Ubuntu to update.
I mostly use Redis in combination with RedisJSON, and RedisInsight is a nice way to check what data is stored. I'm only using it for a handful of small documents which mirror the state of some devices.

These options (Redict, Valkey) don't seem to support JSON as a data type, so I'd like to know if there is some server specifically made for dealing with JSON documents. Something like a very lightweight MongoDB server which can be managed via a browser and where the data can be inserted/updated/removed via HTTP calls.
Pretty much this. Some of the actors that would be affected by this are as large as can be.

Sshd is used everywhere.
OpenWRT also uploaded backdoored packages.
I'm now imagining a department where every single worker is a spy for different government and they play endless game of "add exploit, close off the other people's exploits". And all of them think they are the 10x developer because all the other people do in their view is pushing shoddy code
UN? FBI? World Bank? Deepfake police chief used for compensation scam video