skysight-inc/HackerNews huggingface dataset:
>Like Florida with crazy hurricanes, no reason to be spending money on something besides asphalt architectural style shingles. Some people do get metal roofs. But if its going to get blown off, then why?

Tile and metal roofs last much longer than asphalt roofs in Florida, and while it's definitely more up front, they're generally more resistant to extreme weather (tiles are very heavy and metal is generally fastened down very well) and may get you an insurance discount. It's also for aesthetic reasons, as tile roofs are a very classic Florida look, and the stereotypical Key West house has a metal roof.
> Do they not test against the real thing and assume their test cases hit every corner case?

That's not developers responsibility, we can write tests only for our known knowns and known unknowns.

This thread was more around the author who doesn't seem to understand that taking the full source(at least once) is a vital part.
Exists! [1]

ZFS seems to be the most cross-platform of the modern filesystems. Although there's a Paragon driver for APFS for Windows and a FOSS driver for native Linux APFS as well as one for FUSE.

Personally, I keep track of bcachefs which got merged in Linux 6.7. But it won't be cross-platform.

[1] https://github.com/openzfsonwindows/openzfs

[2] https://bcachefs.org
Yet most murders go unsolved.
The US is very lax about enforcing speed laws compared to other countries.

Compare to somewhere like Australia where you get fined for just going a few km/h over the limit and the use speed cameras extensively.

https://www.qld.gov.au/about/newsroom/increased-penalties-fo...

Whereas it seems to be common in parts of the US for everyone on a freeway to be 10 miles/hour over the limit and nobody cares
> There is no field of "probabilistic UX" for example. How do you provide a consistent user experience when the underlying engine of your application is inconsistent?

Sure there is. Every single in person store you go into and how staff are trained to interact with customers. It’s hard, and yet there are clear experts in it.
"Language models can explain neurons in language models"; GPT-4 can help explain what GPT-2 neurons do:
https://openai.com/research/language-models-can-explain-neur... https://news.ycombinator.com/item?id=35877402

IDK if this is a practical limit to such research? From https://news.ycombinator.com/item?id=38753725 :

>> "Challenges with unsupervised LLM knowledge discovery" (2023) https://arxiv.org/abs/2312.10029 :

>> Abstract: We show that existing unsupervised methods on large language model (LLM) activations do not discover knowledge -- instead they seem to discover whatever feature of the activations is most prominent
All these AI researchers treating “..is all you need” a meme or something.
Recommend anyone interested in a agent framework lookup AutoGen by Microsoft
A man who ran the entire length of Africa
All households run on the edicts of Communism. "From each according to their ability; to each according to their need".
Unfortunately, it doesn't scale.
Ask for Permission to Ask
Short summary is that it allows auth bypass, not just RCE.
Your friend should realize that a basic GAPS diet would resolve 99.9% of their IBS issues. Literally throw some chicken and bone broth in an instant pot and eat that daily. A little salt. That's it. Do it for a year. Hell, do it for a month.

When your gut health bounces back, start to mix it up again.

" I didnt' see my family, I didn't see my friends. I slept on the factory floor."

Oh, and maybe stop doing that too. Chronic stress equals chronic inflammation equals IBS and an array of other issues.

This mentality is utterly baffling to me.
Posted about 20 times, with the most discussion at https://news.ycombinator.com/item?id=24642134
Theremino – connect computers with the real world – applications
Another aspect is the prevalence of bullying against gays, once pictures are taken. If gays are sometimes killed even in France (Lyon, 2015), it’s worth wondering whether you want photos of yourself at 18, in a country that could evolve both ways for the rest of your life.
One measure might be that we never really found that many backdoors. Over time there is quite a large accumulation of hackers looking at the most mundane technical details.

This may be confirmed by regular vulnerabilities that are found in sometimes many decades old software, since vulnerabilities are much harder to find than backdoors. For example shellshock was 30 year old code, PwnKit 12 and log4j was ~10 ish.

So if backdoors were commonplace, we probably would've found more by now.

Perhaps that's changing now, the xz backdoor will for sure attract many copycats.
I think they've been overfitted.
Well then most will be demanding that our governmental institutions issue cryptographically signed ID cards verified by an in-person visit to the DMV.

Or, you choose to opt out and swim in a sea of nonsense.
You may be right, but it is not obvious (in the case of the sea floor), especially because industrial fishing is so devastating. "Worse" is not enough information, for example if it is "slightly worse" at a point were it's under the variability of the destructing action of fishing. The benefit for the energy transition is to take into account too.

It's worth investigating, in any case. I'm not advocating for taking action before getting the results of such study, though! It is important to be careful.

The only crushing argument that I would admit at this point is: "industrial fishing should not exist in the first place".
Yeah, and I suppose LeCun has been talking about the power of self-supervised learning long before the rise of LLMs.
Kerr-enhanced optical spring for next-generation gravitational wave detectors
OTOH, the Bitcask paper can be implemented in about a week for a write-ahead log that’ll give you pretty strong guarantees.
It's as if it's not going away...
I don’t think insurance companies should be forced to protect you from your own outsized risk taking at a government capped price.
That's not enough to get it to load in a browser. Which bundler will you use? Shark jumped.
Yes, I understand.. It's just not a surprise.
> At the end of every year, if the amount of money left over exceeds the formula they have set, every policyholder gets a refund.

That's commonly a requirement of regulation too. I've had refunds from car insurance and healthcare insurance because claims were lower than expected.
gp means they're accidentally getting people used to using VPNs etc by poorly implementing bans on popular things.
Looking into spectroscopy and x-rays I have encountered theremino in multiple places on web. I thought HN might find it interesting as well.
Ibiza locals living in cars as party island sees rents soar
I did a lot of stuff on that machine. One was an interactive processor so users could write their own simple programs to do whatever they wanted. It had numeric and string accumulators and numeric and string operators.

One program I wrote for it could take text and convert it to pig latin.

IIRC, the processor was about 12,000 lines of 360 assembly language.
Then most murderers are geniuses.

Or most murder investigations are (by definition) incompetent.

Or (more likely): The old idiom quoted above is stupid and useless. (That it presumes that murdering and getting away with it is somehow a noble or esteemed deed should be damning enough.)
Not seeing that as a point. It's probably not possible to have no performance hit whatsoever when you're checking the exact nanosecond count of every little thing. But usually nobody is doing that. It shouldn't be hard to not cause a substantial enough performance regression in SSHD logins that somebody who wasn't already monitoring that would notice and decide to dig into what's going on.

I'm not sure if it's been revealed yet what this thing actually does, but it seems like all it really needs to do is to check for some kind of special token in the auth request or check against another keypair.
Sure, but almost no knowledge that is interesting, valuable, useful, etc., is absolutely, positively critical to your life. Almost nothing on HN has that level of importance, but you are here learning interesting things, and unfortunately the first place some of those things appear is still Twitter.
In terms of buildings, I've always had the impression but brutalism wasn't so much about being unhelpful, but more about making the users feel small and unimportant...

... Which in a weird way describes some rather snazzy websites with inconsistent content policies and Kafkaesque appeals.

Since it's hidden, it's a kind of cryptobrutalism, to (perhaps unnecessarily) coin a new term.
I mean, even aside that? If you spend the money on European developers instead, that's jobs and tax dollars here.
This is how I think humans work. We have 5 or 8 versions of us running around in our skulls or whatever and one of them is somewhat of a supervisor.
I don't even know if that's true, but I don't care. Twitter, at this point, is far more egregious than reddit, and I swore months ago I'd never contribute there. It blows my mind that people still play in Elon's piss-filled sandbox because they love the dopamine hits of bot-inflated engagement metrics.

Yes, you casual reader that keeps posting on Twitter due to laziness and momemtum, I'm absolutely talking about you. Your laziness is hurting everyone. And I'm not alone, you're limiting your audience and prioritizing, well, people too lazy to get off Twitter, and ignoring the technical, prescient (observant, at this point?), informed crowd that have left for elsehwhere. /shrug
> Is the author taking playful liberties with the metafictional "translation" here

Yes. Unless there is another version of the text, unknown to me, on which the translation is based, the Ancient Greek sentence reads as follows:

Ἡμῶν δὲ τὴν ἄλογον ἀποθαυμαζόντων ἐρώτησιν καὶ ἐς ἀλλήλους ὁρώντων, διετέλουν πρὸς ὄχλου τῆς ἀποκρίσεως ἕνεκα γινόμενοι.[1]

Literally, I would translate it like this:

"About this illogicality marvelling we asked ourselves and looked at each other and finally gave to the group the following answer."

[1] Source: Prisci Pantitae Fragmenta 8.: Exc. De leg. Rom. 47-71, published in: Fragmenta Historicorum Graecorum, vol 4., Paris 1851 -- Digital facimile at https://books.google.de/books?id=quBFAQAAMAAJ&pg=PA77 and professional digital transcription at https://www.dfhg-project.org/DFHG/index.php?volume=Volumen%2...
Has anybody done a writeup of the obfuscation in the backdoor itself (not the build script that installs it)? I threw the binary into Ghidra and looked thru the functions it found, but having no familiarity with the ifunc mechanism it uses to intercept execution I have up and set it aside for others.

I'd have to assume since there's anti-debug functionality that the code is also obfuscated. Since it shipped as an opaque binary I assumed at least some of the code would be encrypted with keys we don't have (similar to parts of the STUXNET payload).
lol I bought a 3 in December just to avoid this atrocious refresh

Pretty sure it's my last Tesla

I like stalks. I liked ultra Sonic's and radar too but.. yeah.

I'm not sure there's anything Tesla has done in the last 2-3y that actually makes me want their product more. It's been very much the opposite.

And I've had one since 2015.
How’s that prejudice? If you went and worked for Tesla after 2020 when all of their flaws were out in the open, then you opted into that environment. Are you saying you don’t make hiring decisions based on resume and where people worked? Hiring is always a subjective process. “Cultural fit” is a thing.
GP mentions brutaldon.org and I cannot understand how to use it or what it is. I spent ~30sec there and it was not enough to learn how to use it. Doesn't look as user-friendly for me.
You could say you were learning math:

https://kotaku.com/on-pornhub-math-teacher-makes-his-mark-te...

https://news.ycombinator.com/item?id=28934711
This is a fine article, but it ends right when it starts to get good. I was totally ready for the less common knowledge or a juicy story.

I am on Lutris a lot. It's awesome what can be played on Linux these days. I think it may end up being the primary home of vintage gaming.
My first thought was something like, "well, I guess with GNOME and KDE both defaulting to- wait, they probably mean the thing formerly called Twitter, don't they?"
I feel like the type of places with heavy handed censorship are also not the type of places you want to go "well, actually..." to the government.
If they aren’t technical enough to know your setup, they won’t know their current setup either. No big deal, keep it relaxed.
Looks like you disagree with TFA.
One frustration I've had with all this mixture-of-experts research:

Randomized Algorithms 101 - or basic stochastic reasoning - suggests that if the temperature parameter is > 0, querying an LLM N times and picking the majority result (perhaps with an N+1th query to the LLM) will generally result in better performance than asking it once and choosing that result.

It seems plausible to me that the gains can be further improved with a specialized mixture of different LLMs (which could then be run at temp = 0), or by finding better ways to break tasks into subtasks as this paper suggests. But AFAICT nobody has done anything to actually quantify these hypothetical gains versus the dumb randomized algorithm approach! In particular there might be voting strategies or mixtures - even specific models - where MoE/etc is strictly worse than naive repetition.

I am a concerned citizen w.r.t LLMs rather than a researcher, so I might be missing something. It just seems odd that LLM researchers forgot the first chapter of Motwani/Raghavan.
If you're trying to say that immunostimulant is a term of art distinct from immune checkpoint inhibitor, then fair point.

But what it seems like you're saying is checkpoint inhibitors don't "enrage/activate" the immune system, and they only target tumours, and both points are misleading if not outright wrong.
I have no idea what you are even trying to say. In this thread we are talking about how cybersecurity is broken and how certification requirements have been continuously degraded to allow insecure systems to be deployed in inappropriate contexts. This has removed one of the vital incentives for secure systems, having requirements that actually demand and verify security instead of just caving into vendor incompetence. Saying that people use systems known to have poor security because they are not required to use systems with high security supports my point.

It is not even like they were asking for the impossible. High security systems designed and verified to protect against state actors were developed and deployed. Just everybody demanded they be allowed to use cheap garbage because they value their budgets over your security.

Incidentally, we also learned from this process that it is basically impossible to retrofit security onto a insecure design. Any system with a insecure design must be thrown out and redesigned from scratch. Numerous attempts over multiple decades and billions of dollars were spent trying to retrofit security onto existing designs and literally every single one of them failed to this day. Attempting to "harden" existing systems to achieve meaningful security is just a fools errand when there are plenty of examples showing you can develop a secure, general purpose base from scratch, and no examples of anybody ever successfully hardening a existing system.
Tesla recently added FSD to my car for free for a month. In the first 5 seconds, pulling out of the drive way, it attempted to side-swipe my brothers car.

So don't expect a big upswing in FSD subscriptions this quarter, although someone is gonna brag about an epic number of "activations"
Ensemble of any number GPT 3.5 agents is less accurate than one call to GPT-4.
> This is nonsensical

California spends about $600bn a year on construction [1]. That’s 15% of its GDP [2]. Let’s say half of that is residential, in line with the nation [3].

The proposal is thus to monetise 7.5% of GDP. That is literally Argentina [4].

[1] https://fred.stlouisfed.org/series/CACONSTNQGSP

[2] https://en.m.wikipedia.org/wiki/Economy_of_California

[3] https://www.agc.org/sites/default/files/Files/Construction%2...

[4] https://www.statista.com/statistics/316916/argentinas-budget...
A Helicopter Crash Nearly Killed Amazon Founder Jeff Bezos in 2003
This. Could people stop posting xitter links and post threadreaderapp links like this instead. Thank you.
Bicyclists earn it too.
though I can safely say that $500k year is VERY HIGH for a CISO. I know CISOs for publicly listed F500s who earn around 200-300k at most after 15-20 YoE.

…

If I'm honest, most security engineers suck. 90% are crappy IT Admins or Compliance Monkeys who did CISSP and maybe worked for PWC or an MDR for 1-2 years and don't know the difference between NFTables and NTFS. Most CISOs and VP Sec are former security engineers in turn.

You get what you pay for. Dinosaur companies still can’t stomach paying “nerds” more than their Assistant Regional Managers and it shows. Maybe they’ll be extinct soon.
They're also working out how to build them without easy access to water (NB: edge of the Gobi Desert). These are exciting developments.

https://www.abc.net.au/news/2021-08-28/china-thorium-molten-...
Hopefully also a boom in voting against these folks as well
Hm, I don't know if Mullvad uses shielded VMs for their infra. I guess it would be neat, but I'm more talking about privacy-oriented generic-hosting providers that provided shielded VMs.

Maybe it's just where my head is at, but I look at something like the GP's post and go "cool!" and then realize that such a property would be a prime example of a honeypot. Do I think there are individuals interested in offering low-margin "privacy" VPS services that accept crypto? Yes. But also, I suspect there's plenty of intelligence outfits that would spin up such a project as a fun side project to spy on guest VMs. :| Unbounded money goes a long way. And while I like to cosplay paranoia, I just have to assume that clients of such services are seeking anonymity for Reasons.

Shielded VMs + monero payments would at least move the bar up to "you need to be a target worth leaning on AMD/Intel for shielded-vm compromise".

Granted, I think you could also create infra architecture that allows you to treat these cannon-fodder, but I digress.
Uh, up until the last 20 years or so, CHP bikes were like that.
No full dissemination of the backdoor itself has been done yet, as for the anti-debug, sure you can avoid things like that with flags. But this was done at compile level so its a bit more tricky.

> I'd have to assume since there's anti-debug functionality that the code is also obfuscated.

Not really, as above it was done at build time.. So you have already set your home up.

It's shown the problems with package managers not taking source from the right place.
Thats gross.
- "Physicists Have Figured Out a Way to Measure Gravity on a Quantum Scale" with tantalum https://news.ycombinator.com/item?id=39495482 :

> "Measuring gravity with milligram levitated masses" (2024) https://www.science.org/doi/10.1126/sciadv.adk2949 :

> Here, we show gravitational coupling between a levitated submillimeter-scale magnetic particle inside a type I superconducting trap and kilogram source masses, placed approximately half a meter away. Our results extend gravity measurements to low gravitational forces of attonewton and underline the importance of levitated mechanical sensors.
Reinsurance isn’t magic. This helps with one-off losses, but if you’re fundamentally not able to make a profit, they’re not going to cover you, because all you’ve done is shift the negative expected value to them.
How do they get around the account/resource limits?
What is the purpose of using this in production? I thought people just ssh into Linux if you need it to just work. For my own purposes I used to use an ext3 driver on Win7, never failed on me, just switched to Linux.
Does it matter? There is no clear definition what AI is. Does you definition of AI include thermostats?
Zimbabwe launches new gold-backed currency – Zig
The solution seems to be to remove the insurance mandate, and allow purchasing insurance across state lines. That way two locked-in markets are opened to more competition.
Let’s be realistic - this is not about age verification but about restricting people from their rights to view a particular type of content because of how one religion feels about it. The age verification is just the smoke screen the Republicans use to take away your freedoms.
Its still total garbage, it was spun.
I personally visualize them at a table from time to time.
Anybody who ever paid for FSD are some of the most smooth brained people.
“Each fine tuned toward slightly different aims”

So…a sort of mixture of experts if you will
In fact, you are wrong; insurance in California is redistributive by regulatory design. Farmers (when operating in CA) must offer insurance X% of homeowners in a range of $Y-$Z, subsidizing those customers who are more expensive to Farmers. It's relevant to the story: Farmers is disallowed (for political reasons) from canceling accounts in Auburn due to actuarial climate updates; Farmers has new incentives to closely scrutinize home conditions and utilize any new datasets.
All you need is all you need.
I thought performance was actually fine? It only dragged when using valgrind, hence the rhetoric that it took some really unlikely circumstances for it to be detected that quickly.
This seems related to an interesting recent ACM ByteCast podcast episode with Edward Chang, an Adjunct Professor in the Department of Computer Science at Stanford University. [1] (Note there is a transcript if you don't want to listen.)

The approach he uses is to arrange for multiple LLMs to dialogue between each other about a discussion topic where the human acts as a moderator instead of the question/answer format that LLMs commonly take today. They find that the final answer that multiple LLMs come to in dialogue results in a huge improvement in both precision and accuracy for the same resources.

[1]: https://learning.acm.org/bytecast/ep50-edward-y-chang
I really used to like Knob Creek but haven't had it in a few years.
Seems weird that the author continued sending their kid to the school...
iirc ihostart actually host their servers in their basement, which is bad for reliability but perfectly fine for this use case. The operator also claimed to be an 18 years old, not sure if it's true but if it does I applaud their entrepreneurship spirit at such a young age.
EAL5+ becomes very very very niche and hardware driven.

EAL5+ only really kicks in for cryptographic systems (think SmartCards and whatnot) or very critical RTOSes developed by Green Hill.

The RoI on formal verification just isn't there, and imo detracts from a lot more pressing and basic security concerns that can and need to he resolved.

Something like SKPP just doesn't make sense outside of certain niche usecases as you mentioned. Like, you can have a nice formally verified kernel, yet you still need to ingress and egress data. You might retort that you can encrypt, and then I can retort that I can MTIM, .....

The cycle goes on and on and doesn't resolve the core fact - nothing can be 100% secure. And Formal Verification, while a useful tool, cannot solve all security issues.

And being friends with several 8200 and similar program alums, trust me when I say formal verification wouldn't solve some of the attacks or vectors they would use.

David Micken's article in USENIX about realism in security a couple years ago is a good overview [0]

[0] - https://scholar.harvard.edu/files/mickens/files/thisworldofo...