skysight-inc/HackerNews huggingface dataset:
Just because there isn’t a “novel exploit” doesn’t mean this isn’t a big deal.

Snowflake is susceptible to their SE’s having credentials stolen. These credentials can bypass MFA. And per the article, they have no expiry. That’s strikes one, two, and three.

Snowflake’s security practices lead to a situation where their customers are either required, or at minimum encouraged, to share access to broad datasets with Snowflake employees. That’s strike four.

Yes, there is also issue here that the customers are responsible themselves for not granting too broad access, and that’s on them. But it’s also on Snowflake for not having a better system that doesn’t require this access, or at minimum not having better oversight and control over this transitive access.

Once these accounts are granted access to a customer’s data, they aren’t “demo accounts” anymore. They’re real accounts, with real, very valuable data, and they should be treated as such.

Edit to add: it is worth noting that Snowflake claims the demo account did not have access to customer data and wasn’t the source of the leak, which is in contradiction with what the attackers claim.
well I was going to use it for Spotify, but without official support it's going to be a pain. Unless someone's already hacked it.
Many companies outsource their customer support staff as well.

That, and the fact that LLMs are now available to pretty much anyone for effectively nothing, would make me very cautious in basing my judgement of something being a scam or not exclusively on a caller's accent, spelling, mannerisms etc.

Lately, it's actually been quite the opposite in my experience, and I don't find that too surprising either: A lucrative scam business can afford to pay much more than the average US company that sees customer support as a cost center to be optimized at any cost. So why wouldn't their staff's English be better?

Social engineering scams are about to become a lot more exciting (in a bad way), not least thanks to LLMs (with and without voice capability), and I think people are absolutely not ready for it, not even us professionals working in tech.
Getting adequate good quality sleep is the first place to start. Track your sleep, maintain low sleep debt.

Intermittent fasting helps with a lot many things, portion control, snacking, insulin sensitivity, mental clarity.

Resistance training is essential. I go to the gym and play around with weights. Having a personal trainer makes a huge difference here. I go first thing in the morning 5 days a week. Either that or I don’t go. Early morning workout also makes me feel like the rest of my day is easier in comparison to the literal heavy lifting I’ve started my day with.

For cardio, you want some kind of explosive high intensity workouts and some sustained medium intensity ones. Resting heart rate is a decent way to measure your improvements here and I’ve noticed that the higher my heart rate goes during workouts, the lower it goes during rest.
How would you define a "mobile OS" then, to keep the alignment of what you said, particularly this part: "There are always going to be unpatched and uncaught vulnerabilities"?

Everything which can fit into a pocket and has a HTML5 browser?

FYI, I know about how extremely vulnerable average cellular baseband is (and that it would often use unprotected or weakly protected DMA). Let's assume the device in question doesn't have one of these.
Not sure why throwing in the randomly assigned label of millennial, but fine, I also fall in the category and I've taken to just calling people and companies.

First of all, understand that many especially smaller companies have people who has the job of answering phone calls. Rather than doing a multi day back and forth via email or chat where you're one out of five that "agent" is currently servicing, calling is really really efficient. Clarification and confirmations are instant, alternatives can be quickly discuses. I call because it's efficient.

Also, have you ever noticed that most people SUCK at email? Try sending an email to company with two or more questions. What will happen is that you'll get an answer for the first question and then they forget about the rest. The larger the company the more likely this is to happen, because they can deal with three issues in one support ticket, at least that's my theory. So now you need three email.

I used to hate calling people, but I found that I hated uncertainty more and I hate getting wrong half answers to my questions. Calling people fixes all of this. Always call, but get confirmation in writing.
That doesn't sound right to me: Google used to suppress results with string matches?

Why?

If so, would that be a good thing?

Why shouldn't I be able to find the vehicle via its ID?
I had a Samsung Galaxy S4 with the dock with Micro-USB for the phone and behind that a slot for a user-replaceable battery.

It took 2 seconds to pop the back, 1 second to remove the battery, 1 for the new one, and 2 seconds to click the back back on.

All around a battery swap took 1 minute which included phone booting.

Oh and that S4 was waterproof.
That seems like the mostly likely way, at least for the new items stolen from retail. Trying to sell on craiglist/FB marketplace doesn't seem like it would scale. An unscrupulous hardware store owner could mix the stolen goods in with their stock to pad their margins. The tools could also be used as stock for 3rd party seller on Amazon.
What is the difference between a google map style application that shows pixels that are "right" for a road, and pixels that are "wrong" for a road?

A pixel is a pixel, colors cannot be true or false. The only way we can say a pixel is right or wrong in google maps is whether the act of the human utilizing that pixel to understand geographical information results in the human correctly navigating the road.

In the same way, an LLM can tell me all kinds of things, and those things are just words, which are just characters, which are just bytes, which are just electrons. There is no truth or false value to an electron flowing in a specific pattern in my CPU. The real question is what I, the human, get out of reading those words, if I end up correctly navigating and understanding something about the world based on what I read.
Ubuntu tends to push their proprietary snap format, even replacing some dpkgs with secret snap shims.

Fedora will usually push major Linux changes before other distros; systemd, wayland, cgroupsv2, btrfs, etc.
Tax-loss harvesting.
Who says IP was ever right in the first place? A bunch of wealthy, powerful people?
It did automatically detect MacBinary, I think there's even some example out there of someone doing exactly this. You don't need a terminal on the old Mac, but they did use a new Mac because it came with the macbinary tool preinstalled which makes it all very easy.
Look out below: AI's double-edged sword slashes Dell, MongoDB, Salesforce, more
Not necessarily. In Canada, a case in February (https://www.mccarthy.ca/en/insights/blogs/techlex/moffatt-v-...) held that Air Canada could be held responsible for incorrect information about a refund given to a customer by its chatbot.

Notwithstanding differences in jurisdiction, applying that idea to this case would rely on finding that Meta owed Gaudreau a duty of care that extended to the Meta AI chatbot.

It would be more difficult to make this claim if Gaudreau had asked the question of Google, since Google itself is not usually responsible for false information uncovered by its searches.
That feels like a high bar for FOSS (maybe for any software...), but given how long Wayland has been getting worked on, you'd hope it's at least usable for most (but not digital painters, apparently).
Step 4 is right in the article:

"they were able to sign into a Snowflake employee’s ServiceNow account using stolen credentials, thus bypassing OKTA which is located on lift.snowflake.com.

Following the infiltration, the threat actor claims that they were able to generate session tokens, which enabled them to exfiltrate massive amounts of data from the company"
I found the example where this exact ClarisWorks process was used: https://forum.vcfed.org/index.php?threads/transfer-applicati...

Because serial ports (and modems) were pretty much the default thing to use (besides LocalTalk and AppleTalk) the desktop software usually supported that out of the box, no terminal required. This is also why Fax support was built in, because even then, any other type of peer connectivity wasn't really big enough. And around that same time, ClarisWorks was also really common on Macs.

Now, we don't know for sure that the author also had ClarisWorks, but we don't really know much about what was available in general (except the games, the sound files and the fax). But in general serial file transfers, modem and serial based methods were pretty 'normal' to have.
It's "own your condo" vs "rent a condo" safe. You aren't safe from standard stuff going out, but you are safe from your landlord evicting you.
Fair enough, but not having scoped secrets is a red flag.
It's good economic policy based on what? Did you run a counterfactual already? Comparing the US to other countries is meaningless, it's not the same set of init conditions and variables.

Do you realize that those taxes go to fund public services and help people stay afloat, which I don't need a study to show you, creates far more customers for all these tax evaders in the first place? Go back 50 years to see what this country used to be and how much shit it got done and compare it to today. There are measures of productivity engineered in math, and then there is common sense: majority of existing infrastructure was built decades ago and now it costs billions in overrun projects to build a single station in NYC.

The current system works just fine in terms of punishingly taxing everyone on this website and the poor, that's why it feels like I'm contributing half of my salary to the federal government. What it doesn't do is take its share from extremely wealthy, who in turn DO NOT SERVE the economy because they're effectively stateless agents, who can put their money into Seychelles or whatever. Nobody would bat an eye if those billionaires would contribute the billions to the economy. Instead you get people crying about how "the government is inefficient, it gets nothing done, I'd rather the titan spend it as they see fit." But if this ship called United States floods they will be the first to abandon it, just like a famous critter.

I'm sorry but posts like this are the exact definition of bootlicking.
So again, since obstructing the opposing administration is "normal," you can find statements declaring such an objective. Right?
Do we actually think this way though? When I am talking with someone I am cognating about what information and emotion I want to impart to the person / thinking about how they are perceiving me and the sentence construction flows from these intents. Only the sentence construction is even analogous to token generation, and even then, we edit our sentences in our heads all the time before or while talking. Instead of just a constant forward stream of tokens from the LLM.
Thank you for the kindness :) Doing our best!
They are both pursuing the same goal: making a self-driving car. That makes them comparable. There's nothing stopping Tesla from pre-mapping; their decision not to do that doesn't suddenly make them incomparable.

The only differentiating factor is that Tesla's approach has theoretical benefits, if they can prove it works. If they could hit the same disengagements/mile rate as Waymo, they would likely be ahead since they don't need pre-mapping.

That being said, theoretical benefits are worth about the same as monopoly money. Until they can demonstrate that they can get the same performance without pre-mapping and LIDAR, it's all just conjecture. There are no points awarded for "yeah, well if mine had worked it would have been better!" They might get there eventually, but the current signs don't seem promising. At least not for getting there before Waymo completely eats the market.

Also, at least Waymo's disengagements are known. They're defined by the DMV, it's basically "any time control needs to be taken away from the autopilot". If a human in the car manually takes over, that's a disengagement. If the car decides it can't drive safely and prompts a human to take over, that's a disengagement. If someone has to log in to the car with a joystick to get it somewhere, that's a disengagement.

The only confusing situation I'm aware of is when remote techs give the car waypoints, like if it gets confused in a parking lot. I don't believe that counts as a disengagement because the car is still driving itself, it's basically just failing at pathfinding. That seems reasonable to me, because it's not a safety risk at all, just an annoyance to the business.
If I make a machine that makes random sounds in approximately the human vocal range, and occasionally humans who listen to it hear "words" (in their language, naturally), then is that machine telling the truth when words are heard and "hallucinating" the rest of the time?
Is it really a good idea to give Sam Altman access to nuclear fuel? His followers seem sect like.
No.

LLM's become fluent in constructing coherent, sophisticated text in natural language from training on obscene amounts of coherent, sophisticated text in natural language. Importantly, there is no such corpus of text that contains only accurate knowledge, let alone knowledge as it unambiguously applies to some specific domain.

It's unclear that any such corpus could exist (a millennias old discussion in philosophy with no possible resolution), but even if you take for granted that such a corpus could, we don't have one.

So what happens is that after learning how to construct coherent, sophisticated text in natural language from all the bullshit-adled general text that includes truth and fiction and lies and fantasy and bullshit and garbage and old text and new text, there is a subsequent effort to sort of tune the model in on some generating useful text towards some purpose. And here, again, it's important to distinguish that this subsequent training is about utility ("you're a helpful chatbot", "this will trigger a function call that will supplement results", etc) and so still can't focus strictly on knowledge.

LLM's can produce intelligent output that may be correct and may be verifiable, but the way they work and the way they need to be trained prevents them from ever actually representing knowledge itself. The best they can do is create text that is more or less fluent and more or less useful.

It's awesome and has lots and lots of potential, but it's a radically different thing than a material individual that's composed of countless disparate linguistic and non-linguistic systems that have never yet been technologically replicated or modeled.
You seem to know a lot about Chinese/Singaporean names. There’s something that I’ve been wondering for a while. I know a few people with the same surname in Chinese “黄” but different pinyin on their ID with either “Ng”, “Huang”, or “Eng”. Afaik they are siblings with the same parents so why are their last names different?
These aren't string matches. Check again.
That's going to be indeed an interesting question (also discussed in this sibling thread: https://news.ycombinator.com/item?id=40536860).

My gut feeling is that it should be possible for companies to distinguish an AI product (i.e. as something provided to customers like a search engine, as you say) from an AI "working for them", but I can see a lot more disclaimers showing up in Meta's various AI chat channels soon.
Yea - I'm not advocating to stop participation entirely; just with the hacks/opportunists.

We are so incredibly beyond the government serving the people. They don't reside in the same plane of existence.

The average DC rep would be shocked to live like I did, the average person.
Jimmy Dore interviews a survivor here: https://youtu.be/-h4EUoyZO1I

EDIT: This reads like a conspiracy theory at first glance, but the details give the impression of a PR-foreign policy conspiracy by the LBJ admin. It also helps to have a primary source discuss their experiences, even if he's plugging a book to raise visibility about their survivor group.
Still no progress with small cell lung cancer?

It killed my 43 year old aunt in less than two months back in 2002. Smoker though.
Starlink has its own networking issues thanks to a lot of latency jitter and 0.5% or more packet loss. See the discussion from last month: https://news.ycombinator.com/item?id=40384959

The biggest issue for Starlink at the poles is, as you say, very sparse coverage. Also I suspect Starlink has to usually relay polar packets between satellites, not just a simple bent pipe relaying to a ground station.
Hi, Felipe at Snowflake here.

Here is the latest from Snowflake on this issue: https://community.snowflake.com/s/question/0D5VI00000Emyl00A...

We'll keep updating that URL with any further news.
Yes, AI in its current form is going to be a problem. I'm sure we haven't heard the worst yet. An AI may eventually kill a user.

I believe the heart of the problem is that corporations are riding a hype wave as long as they can, and an AI chat looks like super convincing, next level stuff thanks to the simple interface that hides the fact that you cannot communicate with this one as you would with a human being. You use natural language and it responds with natural language, which makes it not only convenient, but also dangerous.

There's money to gain on all this. While at the same time, hallucinations are an unsolved problem as well as making AI humble enough to realize and tell users that they just don't know. The combination of hallucinating, raising convincing arguments, being confidently incorrect, and not knowing the boundaries of your knowledge base, is a terrible one to let loose as officially sanctioned products.
This 100% - thank you
Are laws even logically consistent. They seem arbitrary at times, and even product of their time, like fashion.
Keep in mind Wayland has been worked on since 2008 when I was still in school. I think some young HN readers haven't even been born yet.

I could excuse it if it had been 4 years old or so, but it's old enough already it can drink and smoke in Europe.
Centuries of milk marketing warped the way we think about dairy and nutrition
Exodus of US law firms from Shanghai accelerates
https://archive.ph/UTmzf
Eh, I've had the questionable pleasure of talking to first level support call centers a couple of times recently, and I wouldn't be so sure about that.

The number of times I've been told that yes, resetting my iPhone's network settings and reinstalling an app will resolve my billing issue or similar...
I'm still waiting for the revival of Google Wave. But I don't think we were simply naive: as we grew up we understood the social and political aspects of it all that weren't taught massively, unlike Google's niceness. We can't blame ourselves for not knowing stuff that was voluntarily kept away.
It's unfortunate that Google is unable to solve this intractable technical problem.
The core is still MIT-licensed and I don't see a great reason why that would change. I've built many plugins for Benthos and Bloblang in the past and I've always been more inclined to use Benthos _as a library_. The Go package is great and the input/output/processor interface are easy to build against. I'm glad that nothing about my ability to do that is changing and I'll be using it again in the future. Benthos is a phenomenal project that is now being sustained by a commercial entity.
It seems somehow like an Indiehacker page, probably taken too lightheartedly. Additionally, the related pages have no real contact details.
1password has support for a custom domain. I bought an old generic webmail provider domain that is now defunkt and use that.

I also use random name aliases on each signup. Even if you aggregate multiple breaches I doubt anybody would link it to an individual (me).

The big remaining issue is payments. I use multiple cards and rotate them regularly (I don't have access to privacy.com or similar where I am based).

I believe this is the future - feed each service you signup to a new set of information and keep track in a password managers. Most services don't care what your real name is (I've been using an alias on services like Uber for ~10+ years).

icloud is also a good option - but I don't want to signal being an iCloud user.
That's even more confused. They never said formulaic songs become popular, they said there is a formula to make popular songs. Those are different statements, and the latter is clearly not true.
Sure, but nothing in story says he did do that.
Now I'm imagining a device that takes as input the roaring of a furnace, and only outputs when it recognizes words.
> The 13 marines who volunteered were trained in historical combat, fitted with sensors that monitored their performance, and fed roughly 4,500 calories worth of goat cheese, roasted meat, olives, bread, water, wine, and other Bronze Age culinary delicacies. And then they had a go at it.

This is science at its best.

> During those 11 hours, a typical warrior in Homeric tales would go through 31 one-versus-one duels, 10 encounters with the enemy on a chariot, two chariot-versus-chariot engagements, and one chariot-versus-warrior-on-ship encounter (a ranged battle where the warrior defended beached ships from charging chariots).
This is what venture capital is, why u so mad?
In theory juries only examine facts but in practice they are equal with judges in they decide both matter of law and fact and can nullify or convict without regard or with regard to either.

The system we use in rural countryside where police basically don't exist, ultimately, is a direct jury of your peer neighbors. It's better if you don't like those decisions centralized to some far away assholes with even less aligned motives.
Same, when I left the US in 2013 I was early career and the gap wasn’t as big but now it seems like European pay is just atrocious. I was ok with a 30% pay cut for quality of life, not 60%. Weak euro doesn’t help either.
> If a huge mechanism for assessing folks in education is "write an essay on this" and the teacher then "grades the essay output by the student," that's almost the perfect task where AI can do both ends. Which is pretty much a sign that assessments such as this have low educational impact.

Disagree here. AI can be (theoretically) trained to do any tasks with which it has an IO interface to perform the task. The same goes for humans, they can't inherently prove they "know" the information, they have to show it, via an IO interface (their hands/voice).

As such, any metric for proving human knowledge could be gamed by AI, assuming an environment where AI could be used (i.e. at home). The only places where AI can be controlled is in the classroom, like during exams or in-person activities.

So to conclude activity X has "low impact" because AI can do it, implies that all education at home has low impact, because AI could do it (through a human performing verbatim what it instructs, ignoring any explanation the AI might give).
Then you'd expect the story to say he did. It doesn't.
My guess was that it was sending back analytics which was developed in such a way that if the servers are not responsive, the thing won't work. So if they unplugged the servers, then no more working Car Things. However, I wouldn't not consider that being bricked. So maybe they plan on pushing on OTA firmware update to brick them???

What would happen if you just stored the unit so that it was not able to receive OTA updates? How long would they keep the OTA update server up and running before assuming all units were bricked and could retire that server? Does part of the bricking process collect the serial number to add to a completed list that your rogue unit would not show updated?

Just curious how far one needs to go to avoid it getting bricked if it would be possible to avoid at all