skysight-inc/HackerNews huggingface dataset:
Because people want that?

In reality, you can do both. You can also do neither. I live in a dense urban core already where it is often convenient to take a bus. But not always - there are those mysterious poles of unavailability. Upgrading it with automatic off-site parking could still free up a lot of street estate.
The large performance regression was a feature of the string obfuscation.
No biggie, I was mostly worried about having proposed something undesired without receiving any feedback about it. I'm glad this wasn't the case.
That was a lot of words.

My takeaways:

* Try not to sweat the culture war, if you focus on doing your thing (even if it has to be your own thing) it has better output than complaining.

* The author really likes Brendan Eich.

I think the first point has a lot of value, by fighting people on opinion you risk sinking into a tar pit and draining all of your creative energy.

If we are on the subject of “the culture war”, I see things as slightly different. I used to be part of a very left leaning (even for Sweden) Ubisoft studio, and inaction towards their political ideology or statements was considered “violence”- I was stunned at the time.

Later I would learn about the thought experiment “Rokos Baselisk”[0]; and I thought it mapped quite cleanly to my situation.

Small companies tend to have a lot less time for external politics, but its definitely something that can be tricky to navigate in larger groups, does anyone else have this experience or disagree?

[0]: https://youtu.be/ut-zGHLAVLI?si=Vz88W38eZCiOWO-h
They have a standalone version of tailwind that doesn't use node.js/npm.

https://tailwindcss.com/blog/standalone-cli

It's not as full featured, but it's pretty good frankly for what I do with it.
That only happens once at startup though?

IIRC the original detection was because sshd was using a lot more CPU coping with the torrent of spam connections any sshd on the internet gets than it usually would.
Totally agree. I’m working for a company right now that put off ‘refactoring’ their tangle of spreadsheets and database query export ‘pipelines’ for over a decade. We are hemorrhaging money right now because it does not scale. And you won’t notice that until it all breaks down.

Now you have effectively created bottlenecks for all critical processes because simultaneously working on spreadsheets is about the most dangerous thing you can do. Data integration becomes a perilous and time consuming affair; there’s no easy way to guarantee conformity between spreadsheets.

You paper over these problems with more code than you ever would have had if you switched to the proper tools earlier.
I think it is a professional attempt. It does not have to be a goverment. There are other cyber criminals.
> It's far from clear how grub package updates work on Ubuntu

It's far from clear how grub works, uprade or otherwise, period.

Much less how to configure it or install it.

Sendmail.cf or jq level configuration language in terms of obscurity.

Cryptic error messages the severity of which is impossible to infer (actual impact being from no impact whatsoever to my computer won't boot anymore).

Not my favorite piece of Linux software by a very large margin.
Vintage computer meetups, like vintage car meetups, are mostly chummy in-group gatherings for the already initiated. It's where geeks of a particular brand can talk shop. (I usually don't attend them and instead go to demo parties[1], which are in no way any less esoteric.)

> There wasn’t really much for newcomers to explain why this old hardware deserves preservation.

It does and doesn't - much like old cars, record players, fighter jets, trains, radios and phones. A handful can be kept around for posterity, as museum pieces. There's a point in not forgetting how they work, since most modern stuff is to a large extent refinements and complexity layered on top of previous knowledge.

But mostly, it's just a fringe hobby. Old computers deserve preservation because someone cares deeply about them and loves tinkering with them. Just like with old cars, record players, trains and radios.

[1] https://en.wikipedia.org/wiki/Demoscene
Fennel might be a good choice for that
> Also less than a year ago age of consent in Japan was 13 years, talk about priorities.

If you read past the clickbait title, however, you’ll find that the individual prefectures have had stricter age of consent laws for many years. https://en.m.wikipedia.org/wiki/Ages_of_consent_in_Asia

Did you know that the United States still has NO age of consent law at all? It’s true, there is no federal law that addresses the subject. (Each state has its own law.) https://en.m.wikipedia.org/wiki/Ages_of_consent_in_the_Unite...
Htmx: I feel sorry for you

React: I don’t think about you at all
in this case it takes advantage of the fact that sshd is compiled with early binding not lazy. The ifunc resolver function is called early, right after the dynamic libraries are loaded. It's eager binding (that's what LD_BIND_NOW=1 / -W,-z,now are doing) is a security feature, GOT table will be readonly early. Didn't help with security in this case lol
> Also less than a year ago age of consent in Japan was 13 years, talk about priorities.

That's a lot like saying the united states has no age of consent. It was higher in every prefecture, with some variations.
Nope, in these examples the +Asset on the left means you received say cash. The right side shows various ways to balance that out based on the accounting equation

I did an explanation with numbers here: https://news.ycombinator.com/item?id=40021506
However we turn it, the moment you have clear split between the common perception and the actual state of things, something has to give.

I'd agree with the parent in letting business models break, instead of people's sanity. Changing labelling laws would be more of a bandaid.
Then if they are shutting down they should be forced to release a server and let people host themselves

This or else don't sell the software implying people own it
Then give buyers the ability to make their own servers.
Was that the origin of Google Books, lol. Presumably, you imaged and OCR-ed the material; did you classify it using USPC/CPC/ECLA? Was there a search service? Was it made available only in Patent Litigation, across the whole org, or to the public?

Any of those documents of 'old stuff' been used for observations to patent offices, or as citations in court - ie did it pay off?

I worked at UK Patent Office 20 odd years ago they had many small troves of journals, books, clippings that individual examiners had collected and classified (UKC, and ECLA). All gone I expect, replaced for patent search by 100s of millions more patent documents, journal articles, and everything on the web.
Hey Mate, great post. I read it all. What I don’t understand is why you are proposing a model (insurance) that doesn’t work in practice, and is susceptible to high levels of corruption. Why this would work differently in the case of open source.
Ice cream consumption linked toml the prevalence of sunscreen
> A big thing with ADHD is as society optimizes, there's less "unproductive" spaces for people to exist in.

I don't think it's that black and white, consider how civilization-changes have made more space for "unproductive" people who would previously have been abandoned for the wolves.
The point is these companies should legally be restricted from using terms like “buy” or “purchase” wherever their game is sold. Instead they should be required to use terms like “lease” or “rent”. The common understanding of terms like “buy” or “purchase” is that you own the item. This is clearly not the case for nearly all games consumers lease today.
This is what the share button gives me. You can google for “gen z programming”.

https://images.app.goo.gl/n2ZNK8JoeUvZe5iN9

edit: I did not know that Yeet was a real thing in programming, even as a placeholder. This is excellent: https://doc.rust-lang.org/std/ops/struct.Yeet.html
Andreas worked on performance for Safari and has also talked to several other people who have worked with the JavaScript engines of major browsers and they have all come to the same conclusion.
So according to their stated information it consumes about 6L of gasoline per passenger per 100km.

Which is:

- much higher than a car

- much lower than a power-boat

- about 25% lower than a Cessna Caravan (which is faster tho).
No need to build and maintain a whole api layer?

One code base rather than two?

Simple pages become simple again?
I can't imagine VCF wouldn't have done that - it's standard practice. But they've also not said their side of this (nor would I expect them to when they'd have been setting up for their yearly event yesterday).

I have friends who are close to the situation and the most I think I'm able to repeat (as it's public info) is that there were management changes between then and now. Based on that alone, and it's a volunteer organisation? Fair to say someone might have forgotten to write down "Don't dispose of these" or the label fell off.

At the end of the day though, it's a bunch of magazines which were already scanned at pretty high resolution. Even most libraries back in the day transferred periodicals onto Microfiche, because there just wasn't room to store the paper copies. I really don't get why there's so much hoo-hah over this.
> México is safe

Did you mean “nothing’s happened to me so far”?
One useful take away from the time I was bored enough to let MLM people attempt to pitch me: "the only thing worse than having a business with only one employee is having a business with more than one employee"
Hey Sławomir, great work! Do you think it can be somehow adjusted to the youngest kids that are not ready for Python, but would like to code anyway?

Powodzenia, trzymam kciuki za Ciebie i Twoją platformę!
Experience report: It will never work in theory
We dont need any tinfoil hats. FOSS projects were being backdoored even before they became a thing the difference is that this time it's state sponsored actors doing it.

The old groups GOBBLES,ADM,ac1db1tch3z,~el8 were doing it, private "security researchers" like isec.pl were doing it.

This time it's a problem because state actors are abusing the corporate capitalism that created this era of underpaid people working on foundational projects. The bad actors have unlimited resources for their objectives.

That's basically what created the demand and ineption of groups like NSO,Zerodium etc..

Basically before that exploits and backdoors were worthless and hackers hoped to be sponsored or hired by companies like Qualys.
Easily? Can be made easily available, but it's not like everything published has been well preserved or is publicly available.
No, AMP was a way for Google to increase their ad revenue and try to prevent people from leaving Google.
I don’t think you need to think of income accounts as negative if the ledger you use enforces an updated accounting equation that also uses negative numbers, See https://news.ycombinator.com/item?id=40021506
Remember how excited we were at the start of the pandemic? "Now we get to find out which of those meetings could have been an email" the joke went.

But now it turns out that almost every email exchange degrades into "let's get everybody together and have a quick video chat about this"

Ha ha.

I don't think UBI would help the situation as much as people being bold enough to make decisions on their own without a bunch of useless "consultation"
its ours. if that's not a clickbait title i don't know what is.
Only because it was new.
The rule of least power (a bit like the principle of least privilege) is a great thing for both security and understandability of code.
The New York Times is not a news site I regularly read, but I see quite a different set of headlines highlighted on the front page:

Johnson, With His Job Under Threat, Gets a Lifeline From Trump

Biden Wipes Out Another $7.4 Billion in Student Loan Debt

5 People Killed in Stabbing at Busy Mall in Sydney, Australia

Campaign Puts Trump and the Spy Agencies on Collision Course

Republican Women Are Divided on Abortion as Bans Spread

Ocasio-Cortez Never Steered Money to a Key Arm of Her Party. Until Now.

You also list one of these (the last), but the others seem fairly standard things that a newspaper would report, and not clickbait rubbish at all.
I suppose they say that because the article has been written by Kaspersky, and it's hosted on a server under their control?
Is it weird? HN's largest audience is American. The next largest is probably Europe. I'd be surprised if the percentage of Japanese users on HN was high enough to break into the single digit range.

Edit: My assumption seems close, Japan is at 1% based on this. I'm surprised.

https://news.ycombinator.com/item?id=35567986

https://archive.is/20230415023530/https://toolhub.tech/blog/...

It's funny seeing Germany third though. Nobody I know uses it unless I introduced it to them, and I've introduced it to quite a few people.
I disagree, piracy is a bandaid to better laws. I support both, though.
You can work everywhere. You won’t be paid as much everywhere, though.

Even if your motives aren’t simply greed, bigger salaries mean higher barriers to entry, and working together with people that pass higher barriers to entry will move your career faster.
You can only install from the Chrome Web Store. All other methods are annoying and you have to manually whitelist extension ids. I don't understand why the Chrome Web Store does not fall under the Digital Markets Act in the EU. Google is clearly a Gatekeeper here.
Just because PDF files can't hijack your domain, doesn't mean they can't spy on you. Unfortunately, there isn't really an open source tool for sanitizing PDF files.
China is already very advanced, I’d say that when it comes to reasonably large countries (so ignoring city-states) it is one of the most tech/industrially advanced countries out there, if not the most advanced.

For example the US might still have some advances in tech but basic stuff like speed/rail systems are just not up to par, while countries like Japan or Germany might still be ahead of China in some specialized industrial stuff but their tech/IT feels like it’s a geological era behind China’s.

The next billion people that might get industrialized now live in Africa, but the situation is a little bit more complex there.
It absolutely could. It just doesn't. For reasons.
EVs with an efficiency of 150Wh/km charged from a grid that only pollutes at 100g/kWh (eg Brazil, Canada) have a footprint as small as 15g/km.

The US grid is 4x dirtier than that but 60g/km still doesn’t come close to 180g-200g/km of an ICE doing 8l-9l/100km (25-30 mpg.)
It's kind of buried in the article, so probably worth pointing out the "Stop Killing Games" campaign, which will tell you what you can do[0] depending on where you live and whether you own "The Crew": https://www.stopkillinggames.com/

(Admittedly, if you live in the US and don't own "The Crew", what you can do is not much. But if you live in, say, France or Australia and own it, they have a fair bit for you to do!)

[0]In terms of stopping this sort of thing legally, rather than in terms of keeping your own copy playable via cracking, etc.
Litestar has HTMX integration: https://docs.litestar.dev/2/usage/htmx.html
Long term care insurance as public policy
Whether something is a collectable depends on whether someone (ideally several someones) is willing to take it or pay for it ... apparently in this case, they weren't.

Comparing a periodical to a mint shrink-wrapped MTG card isn't really a fair comparison. Even back in the day, most libraries didn't keep periodicals, they were "scanned" (photographed) onto microfiche at the end of every year or two to save space. Some stuff just takes up too much space to store, or isn't practical to when the information is of limited value or already present in another form.
Turning Photos into Paper Art – Create paper animation from any photo
A HTMX-y app will typically be a fetch-heavy app. Think TODO list, where each time you add a todo, you want that persisted on the server anyway. Yes you are sending more down the wire. I doubt rendering a partial HTML template is that much more work than formatting JSON but there is more crap to send down the line for sure.

Where the application is doing lots of micro-level stuff, like maybe you are drawing on a canvas and occasionally sending a payload of updates to a server, I think then HTMX would be much slower and clunkier, and that is when you dust off your React.
>it's important to understand that the author of this could inject arbitrary code into the library that ends up in the address space of a sensitive process. At that point, all bets are off: it could remap the GOT as writable if it so chose, or (this is mostly here for the EDR people will certainly bring it up after reading this) if trying to do that is flagged as "suspicious" or the OS gains the ability to block such a transition, the injected code can subvert control flow in hundreds of other ways.

I think it's important to push back on a very specific point here. It's true in general that if the attacker has added a backdoor in your library, and you're going to call that library's code, you've pretty much lost. Game over. Go home.

But this was a very different attack, in that the attackers couldn't directly target sshd. They couldn't manage to target any library that sshd calls directly either.

The library with the backdoor is code that was never actually called at runtime. This is important because it means it *doesn't* have a hundred ways to reach code execution. It only had a few select ways, mainly constructors and indirect function resolvers.

The amount of weirdness in glibc's runtime loader is not unbounded. There aren't actually a hundred places where it allows random libs to run code before main. And we should take a good look at those couple place that are clearly juicy high-value gadgets to attacker.

When glibc's runtime loader first loads a binary, first reaches a relocation for a STT_GNU_IFUNC, everything is still in a pristine state and no arbitrary code can run without being explicitly called. Attackers don't have magical powers that allow them to run code before you hand them the control flow. At this point in the runtime loader, an ifunc resolver cannot do anything without being caught. It cannot "just open /proc/self/mem" or "just call mprotect". It cannot "just disassemble the caller" or "just overwrite the GOT".

I really want to hammer home how different that is from letting the attacker run code after main. There's nothing you can do if you directly call a backdoored library. But we shouldn't let attackers get away with spending 400ms parsing and disassembling ELFs in memory in an ifunc resolver of all things. Overwriting the GOT like nobody's watching.

The backdoor isn't magic. For all the beautiful sophistication that went into it, it made many mistakes along the way that could have led to a detection. From valgrind errors to unacceptable amount of noise (400ms!) before main.
Thanks for the context! I didn't research OpenTherm much, since my boiler is one of the most basic models on the market. It supports just the bare minimum from V2 spec, but it works, so I'm not complaining :) This boiler was already installed when we bought the house, so not needing to replace it was a great way to save some money for remodelling.

Otherwise, I completely agree that charging 3K for the spec is a stupid money grab. When the time comes to build a new house and choose a new boiler, my choice will be influenced by what protocols are available and whether I can control the boiler with my own thermostat.
I'm pretty certain the median price among all crypto tokens introduced in the last 10 years is 0.
> It does not have to be a goverment. There are other cyber criminals.

Criminals with the resources to maintain such a complex operation for two years?
He's intensely invested in it, and sometimes comes off frustrated at the lack of interest (based on what I see on mastodon, happen to share instances). The suggestion of malware was probably somewhat offensive as it is antithical to bringing disparate retro system users together.

Sorry that happened, but I think he is an unusual case. Hoping to provide some understanding for why it played out that way even though your question was reasonable.
You could write all code yourself for absolutely everything with your own dedicated crew of vetted developers.

Or buy closed source from someone like Microsoft, hoping that they have the resources and actually use the resources to scrutinise code more vigorously.

And there is always the approach of having a great secops team to detect strange network activity and attempts to escalate.
>Let's not criticise Japanese law without acknowledging that US law is also fucked up.

This doesn’t need done at all. This is just whataboutism. This story does not involve the USA and the discussion about other countries does not need to be derailed every time with discussion about and comparison to the USA.
Was it? From TFA:

> [...] despite a large portion of the game being doable in singleplayer [...]
The maximum useful resolution you can really get out of offset-printed magazines is around 200dpi. Scanners have been able to do 400dpi for many years, and have been stuck at the 1200dpi plateau for about as long.

Sometimes you just don't need a better scan, because you're just doubling up on data you already have.
What did you find challenging about it?
I haven't played this game, but the article says:

> despite a large portion of the game being doable in singleplayer, The Crew remained an online-only endeavour throughout its decade-long lifespan.

So it didn't have to be online if it wasn't for corporate greed.
One of the areas of Linux that I slunk away from defeated is understanding grub and the boot process in general for Linux. Either I am stopid or it is stopidly complex or both.
I heard that this deletion was done to remove game files from people’s computers - maybe so they don’t hack the game to make it playable offline??

But they aren’t the first.

Bungie (then part of Activision) famously deleted the original campaign Destiny 2 shipped with and did the same to subsequent expansions one by one, claiming that older content took up too much space on people’s drives or some other excuse.
It's pretty well documented with a pretty simple configuration language (if you already use a bourne shell (and you probably do), you already know how GRUB's syntax works).

I guess reading the manual isn't popular these days, but GRUB has a complete one that explains it all.
what i do miss is a libsystemd-notify. Doing dlopen() is just fixing the wrong prob.

I agree that a simple self-contained .h header file would solve it in a better way.

But I stopped trying to push for minimalism. Sadly.
Alternative Code Editors
I hope the EU also applies this law retroactively and with fines that are a percentage of global revenue. Also it’s worth piercing the veil of limited liability for fraud.
If they're still useful, why throw them away?
Sorry, I don't get it. If you have client side rendering, you need a template for every thing you want to replace, at whatever level you choose (from full page to single element). If you do htmx, you do the same - provide a template for each replaceable part (from full page to single element). In each case, it's your choice how granular you want the updates to be - it can be one per action, or just rerendering the whole page.

Why do you think the client side requires fewer partials, if you use the same scope of data changes?
Invalid memory write apparently: https://www.mail-archive.com/valgrind-users@lists.sourceforg...
The valgrind "fix" was to disable ifunc which disabled the backdoor so the errors went away.

The slowness derived from all the symbol and instruction lookups it did afaik
So I'm renting the bonus features on this old blu-ray