skysight-inc/HackerNews huggingface dataset:
In this context, it means "the one who gives". While the general impression is that such giving is voluntary, it's not an absolute requirement of the definition.

This is a normal usage of language and not some attempt to wiggle around meaning. If this somehow makes you uncomfortable, you should remember that, if you eat meat, or otherwise consume any sort of animal product, or if you have ever done so, then aforementioned animal was straight up killed, humanely or sometimes inhumanely, to make that product.

We domesticate animals to make our lives easier through the usage of their byproducts and this is just one of those usages. Yes, an animal died, but it wasn't killed without reason or justification.

We don't live in a Star Trek world where one can wave some sort of device and the person is magically healed. People are working to get there and maybe someday they will succeed, but until then, imperfect means are all we have.

It's either that or dead humans. Which do you prefer?
Ironically, the only spam I receive these days comes from the address I used here for the "Who wants to be hired" threads.
You need a phone number to sign up for Telegram as well.

And you can correlate username to phone number not that hard in most standard setting cases.
Your app doesn't need a chat feature
Oh me neither, I’m less interested in the results and more that (to someone who has no idea behind the science - me), I’m surprised to hear it’s just now only being tested when I’ve heard this was the main theory of sleep for years.
Weird. I don't think I've ever relied on pickle for sharing data. It's too version specific. I always dump to json, or similar.
openbsd was just an example. other distros and os do patches all the time including changing features but only debian gets called out.
Sure it's an ad homenim fallacy, but it the real world, sometimes you have to make judgement calls on them to just keep moving on.

You can't spend all your days proving Batboy doesn't exist just because Weekly World News published a new article about how he was spotted
Hm f-droid provides privacy friendly https://fdroid.gitlab.io/metrics/ for some time now.

I'm not sure what sort of "control" they have over the Play Store compared to f-droid, but I'd rather have a trusted 3rd party do the building transparently and verifyable.
Pretty sure that Passport is Ben Thompson's (of Stratechery) own subscription management service. Not sure it is out in the world as a product yet.
Also ignoring that some of the economic activity created by these companies can be a net negative benefit to society, cases like: startups trying to solve the mess that healthcare is in the USA, it will generate income, have customers, etc. but it is just providing a service that shouldn't exist at first, similar to how natural disasters will increase a country's GDP because of all the construction required to deal with the aftermath, economic activity generated by patching issues in society is not necessarily a positive. Same with everyone requiring a car to go places, amazing for car sales (and increases in GDP from the production chain) but it's not the most beneficial way for a society to transport itself, incurs recurring costs on car maintenance, insurance, increased road/infrastructure maintenance, injuries/fatalities from road accidents, etc.

The USA has a lot of startups trying to solve issues that probably shouldn't exist in the first place (filling income tax reports for example, what the fuck?) but those bullshit products generate wealth to some people.
CVE-2019-6446 seems to be in the right ballpark.
Marketing doesn't happen in a vacuum. The creative industries have been having it rough for the past year and a half, and there's practically an internet war going on between AI prompt using artists and real ones. Add to that the writer's strike, the job market, etc.

If they had a proper control screening for the ad, the backlash could be anticipated, as shown by the fact on how the simple act of reversing it would have a much different message/effect.
Optional E2E encryption is effectively not encryption. The default encryption in transit is useless if you don't trust the server. The argument about convenience is ridiculous. Whatsapp provides better default encryption than Telegram. The (probably deliberate) flaw in Whatsapp encryption is the default backup method, but E2E encryption is enabled by default with no loss in convenience. Telegram is not encrypted by default, and their encryption scheme has been shown to have rookie level mistakes in it. Just because it's "preferred by activists" doesn't mean said activists have any idea about secure communications.

I'm not saying that you should jump on Signal (or anything else). I'm saying Telegram is almost certainly broken. Maybe maliciously, maybe accidentally, but almost certainly.

For reference, I don't use either Signal or Telegram anymore, but Telegram sets off so many alarms I'd steer clear of it.
Slimmed Optical Neural Networks with a Corresponding Training Algorithm
The crypto payments have to be manually enabled under Settings -> Payments, which is the correct way to handle such features imo.
This doesn't affect the user that downloads these from distro repos or F-Droid because every single update they get comes from the source code. There is never a lag even for 1 second because without the source code there are no builds.

Pretty much all the packages on Linux repos come from package maintainers taking upstream source code, removing parts they don't like and then building that. This is a normal part of packaging and building open-source apps.
I know few people who use Telegram either. All my contacts and I use Signal here.
There are lots of Python pickle remote code execution CVEs https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=pickle
Your points have little to do with security (which is the main angle of Matthew Green's thread), especially because of reproducibility.

Even then

> You need to download it from the Google Play Store.

Factually incorrect, just go to https://signal.org/android/apk/ (and the apk will then update itself) or build it yourself.

> pushed the update to everyone but no one could inspect the source code.

That was for the server code, which you shouldn't care about from a security standpoint for an E2EE messenger such as Signal. AFAIK that was not the case for the clients.

Regarding your other points, they have reasons that have been discussed elsewhere[0] to avoid federation, notably a lot of the progress on the Signal protocol would be way harder in a federated setting. There's no other messenger that has the same usability ("my grandfather can use it and won't have problems using it afterwards") while being at this level security-wise.

[0]: https://signal.org/blog/the-ecosystem-is-moving/
Thanks for the missing context, I think that qualifies as "boosting".
Not everyone is thrilled about existing, and they didn't get a say in that. I could never imagine having children and I never understood why people wanted them, and then I realized that these people must have actually enjoyed their childhood; a concept that was obviously foreign to me. I don't harbor any ill will towards my parents, but nothing for me is unconditional.
> Long analogy short, this is where I think AI for coding is now. It gets things wrong enough that I have to manually check everything it does and correct it, to the point where I might as well just do it myself in the first place.

Even if that were true, reading code is reasonably faster than typing it out and then reading it again to check it.
You can have a secure verified protocol but an insecure implementation of the protocol (the app). Note though that Im not saying that Signal the app is insecure. However I do think that Signal can certainly do more to make itself more transparrent and to accomodate libre 3rd party implementations of their protocol
People have been "angry on the internet" for decades, but it's more recently that it's metastatized into the "real world" on an overwhelming level, and been monetized. This is grossly irresponsible and is going to result in violence and pushbacks, of which the US ""TikTok ban"" (not a ban) is a small foreshadowing.
> Despite it is known to be unsafe since forever and nobody claimed a CVE for this fact.

There have been dozens, if not _hundreds_, of CVEs filed on issues related to pickle and RCE.

Here is a small sample:

https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=pickle
> The telegram protocol has been found to have issues that are, if not malicious, amateur level mistakes.

Please provide evidence of such issues. Because at most, the issues with MTProto were at the level of "we are not familiar with this, but seems ok". Which seem to be inflated by Signal activists into maliciousness.

You do make bear service here.
I'd hope so as sometimes it can take me more than 90 seconds to put an entry in my calendar, which would result in me putting and entry in my calendar for putting and entry in my calendar :)
Is Norway large enough for you? A big part comes down to building up debt that children pay for or in Norway’s case building up reserves that are given to children.
Telegram rolled their own crypto and is used for a lot of intelligence operations like monitoring dissident groups, promoting propaganda, recruiting agents, etc. That probably explains the push to discredit more private apps like Signal.

Researchers of Telegram's protocol have said in some ways it's weaker than TLS.

E.g.

- https://www.wired.com/story/the-kremlin-has-entered-the-chat...

- https://therecord.media/telegram-blocks-chatbots-used-by-ukr...

- https://www.oporaua.org/en/polit_ad/and-telega-is-still-ther...

- https://www.pravda.com.ua/eng/news/2024/05/8/7454849/

- https://time.com/6280190/cia-recruit-russian-spies-telegram/

- https://www.cia.gov/stories/story/cia-launches-telegram-chan...

- https://nordvpn.com/blog/is-telegram-safe/

- https://portswigger.net/daily-swig/multiple-encryption-flaws...
Good answers here:

https://security.stackexchange.com/questions/18197/why-shoul...

I’d do a disservice to try copy and paste here so rather look at the top answer
So since Signal has a board member who worked at a place that some people don't like then the Signal app must be backdoored/compromised/honeypot?

That's one hell of a leap. How far has our requirement for evidence fallen?
some machines had a lisp-friendly CPU even
This is astroturfing. Telegram has never been secure
I'd you told me this a couple years ago I'd give the same reaponse as the reply above
Yes what a great observation.

The ad is so shocking because it's the truth.

We all know it.
You can buy "anonymous number" on fragment without using any client and without providing any personal information and use it as much as you can

When signal becomes at least remotely as popular as telegram it will implement same protection to fight against spammers because you can't have free unrestricted registrations and don't drown in spam

Telegram currently makes it as accessible as possible: either use it freely but register using phone number and official app or pay and use anonymously as you want
Telegram has fully reproducible builds and is not that complicated to build, no issues there. They even have a guide on how to build & verify. [0] No need to wrangle or modify, generally builds as is (at least from my experience).

Granted yes, the version commits are squashed like you said. [1] However I haven't seen source release to lag behind store releases, any sources on that?

0: https://core.telegram.org/reproducible-builds
1: https://github.com/DrKLO/Telegram
> Recently german generals on a video chat were targeted by the russians, wasn't too hard, they did not use any encyption at all

They used Webex. Doesn't Webex use any encryption at all?
It's inherently risky – cryptography is hard and building secure software is hard, so starting it from scratch rather than re-using well-vetted code increases the risk unnecessarily.

It's not inherently broken, but it's sufficiently risky that it may be fair to assume it is broken. History has proven that software that's not known to be secure is typically insecure when it gets to the really hard crypto implementation. I think it's fair therefore to approximate it as "inherently insecure".
The idea that parenting makes a huge difference in kids is 20th century anti-Catholic propaganda perpetuated by WASPs. Outside the extremes, parenting doesn’t make much of a difference: https://www.theatlantic.com/ideas/archive/2024/04/parenting-.... For the vast majority of people, biology will kick in and make them love and adequately raise their kids, regardless of their individual “wants.”
You guys did not create the conditions for something better to do better.
Yes and thats why users spend sometimes months on old builds.

Also which distro packages Telegram?

Fedora doesn't.
Debian does but at times it was so old the client crashed from receiving server comms because it wasn't fully compatible. It actually crashed as in segfault.
> It’s weird to me, because literally every day I get increasing evidence suggesting I have free will within some limits and the universe is unfathomable and unpredictable.

I find the whole subject fascinating, but I am not an expert. I break it down for myself in this manner, so perhaps you could give your view.

If we rewound the universe by an hour (as an example). Literally, every single thing, particle, what have you in the universe is exactly as it was an hour ago. Then you started it again (1). Would you end up where everything in the universe happened exactly as it already did? Faced with the same choices, would *you* make the exact same choices, to end up exactly as we are now?

If the answer is yes, then that implies determinism, and would probably reject what you think of as free will (I'm taking a guess, because you didn't explicitly define free will).

If the answer is no, then it appears that the choices are just random. You have all the same information, all the same moral conindrums, etc, and yet, you just chose something different. Why? In this case, if it is just random, then that also seems to reject the idea of free will.

If there is some other mechanism involved here, could you describe whether it would make the same decisions or not. And if not, then on what basis would the decisions be different?

(1) I'd really prefer to avoid nitpicky arguments about the arrow of time and so on. This is just a thought experiment.
You mean its not the Lucas Arts game from the 80s/90s?
https://eprint.iacr.org/2023/469.pdf
Because the basic understanding of physics is that all particles move at constant speed c in spacetime; the proportion of their speed that is happening in the three spatial dimensions is determined by their mass. So, any particle's speed through space is a fraction of the "speed of light" c; the higher its mass, the lower the fraction.

The other items I mentioned are then caused by the speed of these particles. The speed of sound in a medium is determined by how fast particles collide into other particles in the medium. The speed of the earth around its axis (the length of a day) is determined by the speed of the particles making it up in the warped spacetime of the earth's gravitational field. The speed of chemical reactions is also limited by how fast atoms and electrons move and can interact with each other.
Completely agree. We didn't agree to the bargain when we were born.

That'd be like adopting a adopting a puppy and expecting it to take care of you later because you cared for it and fed it for a few years.

That said, I'll do anything for my father and step mother, they've always treated me with love and compassion.

But my birth mother? She couldn't get the time of day from me. She donated an egg and a laundry list of ACEs, and still refuses to call my husband anything than "your.... Friend" even though we've been married ten years
Letting people share their cars for riding incur increased risks, at least insurance should be different from a family's car who has the usual riders and the odd trip with other people vs a car which is being share with hundreds to thousands of different riders each month. How do you, as a government, ask for a different insurance class in this case? Regulation.

Same with Airbnb, having some guests over from time to time it's just usual life, hosting people to make money is a business and the business of hosting people has different rules than having a guest at home.

We can debate if such rules should be relaxed, if they make sense or need to be updated, etc., but these rules were created out of necessity through time, just allowing some tech company to completely sideline it because "it's tech!" is absurd...
That repo is not fully open.

Release lag -> Telegram foss needs to wrangle the release every time. Fdroid CI takes its time.
do you have any insight if your tech stack works well on mobile, demuxer,ffmpeg....
So, who has actually launched "a pretty intense" campaign here?

https://twitter.com/matthew_d_green/status/17883860908411619...
https://twitter.com/evacide/status/1788040276331884593
https://twitter.com/naomibrockwell/status/178863495226900939...
https://twitter.com/paulmillr/status/1788563576455610552

(I'm pretty sure the list goes on)
Signal self publishes their apk. You can drink directly from the source.
I was thinking about "Loom" an old C64 SCUMMVM game with music.
Signal is still a significant improvement in security and privacy over SMS, Telegram, Discord, X, Whatsapp... It achieved the level of privacy that solutions like PGP tried and mostly failed to achieve for decades. Being tied to a phone number was part of the convenience of their solution. Allowing for nicknames now, might improve on the metadata leakage problem slightly.

I'm sure reactionists will immediately drop Signal because Elon the great said they should without considering that it still might be their best solution to communicate privately with their friends and family. But X makes *all* of it's money from collecting a lot more than metadata from their users, Tesla collects driving data and metadata from all of its customers, Grok trains it's AI on all of the data collected from X, Tesla and other sources without asking if users want to opt out of those training datasets. So I'm not sure Elon has a leg to stand on in this conversation.
Telegram has never AFAIK been open, and is thus insecure and always has been
Well, if you think that AES-256 that MTProto uses[1] is some wonky algorithm...

[1] https://core.telegram.org/mtproto
I think a good response from the R authors should:

• Make clear the bug is due to unsafe deserialization (not serialization as their statement says). This is important because unsafe deserialization is a major source of remote code execution vulnerabilities.

• Update the documentation to make it clear that R’s serialization and deserialization functions are not safe to use for sharing data across the network. Serialized objects should be treated as code, not data.
Which parts are missing?

A couple months ago I actually verified a build of Telegram on my friend's phone as he thought something might be off and didn't have any issues there (the build matched).
They don't know if they could restart the grid? Do they think the turbines will not start, or what?

Why isn't there an emergency plan and scheduled failure testing in place? Netflix randomly power cycles entire datacenters to verify their coordination and fail over plans work. Why does my Parks&Rec stream have better disaster planning than critical infrastructure?
There's nothing talking about Javascript dependency hell. This is one of the reasons why I don't use JS in the backend.
Given that the token says it only allows reading of content and assets of this particular article for 1 month, it seems like this is an intentional feature for allowing subscribers to share paywalled URLs
They want to do this because they want more traction for their blockchain: TRON, which, IIRC, is the payment method for ads, usernames and "stuff" inside Telegram.

However Du Rove is right about a bunch of things:

- Signal clients suck, specially the Desktop one where they ship (or used to) pre-built binaries like their own lib: https://github.com/signalapp/ringrtc
- Also you can't have Signal without Google Play Store
- Signal client suck in usability. I wish I had Telegram client (android) and desktop (qt) instead of this electron garbage. Telegram clients are super-duper-awesome
- I would say that removing phone number requirement is their #1 request. yet they take so much time to address it, specially when they cry about phone number validation SMS costs
- BTW, telegram is implementing a very nice idea of a crowd sourced sms validation, where they use their users phone numbers to send the validation sms
- They have a very questionable crypto integration with MobileCoin, which have a obscure value: they depend on IntelSGX and is 95% pre-mined
Suprisingly, I have the opposite opinion

All the people that preach about single project, contributing only to canonical project and having no alternative implementations need to check their egos, learn about existance of multiple approaches and why competition is better than monopoly

As I see it, article shows how Python, Lua and Ruby failed many people by choosing this approach - causing thousands of devs and millions of users to have slower development and software. Not because it's not possible - but because administratively there's no insentive to do that
Please, I beg you, pick up a history book.

Culture warriors inciting violence against popular culture https://pophistorydig.com/topics/burn-the-beatles-1966/

Or, you know, literally anything from the Children's Crusade to the War of Jenkin's Ear. Raising a rabble to violence has been going on forever.
see my other comment: https://news.ycombinator.com/item?id=40340805#40341928
T is a perfectly cromulent type.
Good point- I forgot that the FOSS clients were 3rd party.
This is childish and / or ignorant line of reasoning that ignores Apple, Google, IBM/Red Hat, Oracle, AWS, etc to land at an odd false dichotomy between Microsoft and "random non-MS software"
Yes but the fact that R was apparently able to fix the issue at all is a bit strange then. You can't "fix" pickle code execution.
I’m not going to buy a Cybertruck, but my Shadowrun characters are definitely going to get one. Finally, the vehicle we were promised for our corporate dystopia future back in the 1080s.
My mother fully expected me to financially support her, her husband and my elderly grandmother, even well before she turned 60. (Meanwhile they were sitting on 4-5 apartments between them). When queried about their spend, it became apparent to me is they expected me to finance a "luxury" lifestyle of travel and pay-per-view cable television.

Unfortunately, some of the "boomer" generation don't really understand one earning is not enough to support a full extended family these days.
When they-them-those know who you are, knowledge of the full attack surface is the better way to compromise because it leaves the first step to compromise uncompromising-appearing. (The attack surface is broader than people generally consider, as it should include over-the-shoulder attacks, XKCD's wrench attack, etc.)

The success of such tactics can more easily be understood by even looking through the many, many comments right in this thread telling us Signal protects metadata because usernames are now a feature - guys, Signal has the metadata as the *services* are what is the topic of discussion here, not other users.
Wool – Excerpt (2013)
https://neilyoungnews.thrasherswheat.org/2022/01/neil-youngs...
"You do make bear service here."

I'm not sure what this means.
Those are CVEs on other software that use pickle in insecure ways. Not on pickle itself.