skysight-inc/HackerNews huggingface dataset:
There are many wannabe security researchers who find issues that are definitely not exploitable, and then demand CVE numbers and other forms of recognition or even a bounty. For example, there might be an app that crashes when accepting malformed trusted input, but the nature of the app is that it's never intended to and realistically never will be exposed to an adversary. In most people's eyes, these are simply bugs, not security bugs, and while are nice to fix, aren't on the same level. It's not very difficult to find one of these!

So there is a need to differentiate between "real" security bugs [like this one] and non-security-impacting bugs, and demonstrating how an issue is exploitable is therefore very important.

I don't see the need to demonstrate this going away any time soon, because there will always be no end of non-security-impacting bugs.
I think the text is meant as a checklist you can use to apply to some system, not a list of impossibilities.

For example:

> Events will arrive in order, even if specified by the producer contract

This reminds me of a system I worked on. It used FIFO queues, but even with very low throughput we were getting out of order records on our database.

It turns out there was a rogue worker re-queueing some items into a non-FIFO standard queue that CAN deliver out of order stuff, and that was messing things up.

We were trusting the producer contract, which works well enough, but there were guarantees we needed to make on _OUR_ side to ensure proper ordering all the way through.
"one more lane" a buss lane means more hard and hot surfaces in a city. As long as you just add hard surfaces you are still making things worse. With that said buss lanes are more important than car lanes.
Interactive rebasing away fixups in your branch is not squash merging. I agree that fixing a typo in a variable or a small linting issue in a previous (recent or not-pushed) commit in your branch is usually good. A carefully crafted commit history is all anyone can ask for. But then squashing away that history once the PR is merged would be a waste of a good history and the effort you put into it. If you end up squashing your history away anyway, why bother cleaning it up in an interactive rebase?
I don't disagree with anything you say but try telling my 16 year old daughter she need to jettison any form of social media and go with the nerd crowd.
But it’s not just the block sizes, it’s also the streets. Often Western Sydney streets have no trees at all (and even no footpaths)
> People who track link usage use links to a tracking service which redirects to the target, or embeds tracking metadata in the URL

Link analytics is explicitly one of the stated use cases on Bitly, and you can even add UTM parameters automatically:

- https://support.bitly.com/hc/en-us/categories/360001889231-B...

- https://support.bitly.com/hc/en-us/articles/115003371927-How...

> Nothing about a shortener helps you block spam URLs - quite the contrary, they tend to be used to hide spam URLs.

It does, like on Twitter where ever url is behind a t.co shortener. If a spam url is identified you just have to kill the t.co url redirect.
> There are many wannabe security researchers who find issues that are definitely not exploitable, and then demand CVE numbers and other forms of recognition or even a bounty

I believe this has happened to curl several times recently.
In libgmp I think the numbers have to be around 100,000 bits or 30,000 digits for FFT to be faster.

https://gmplib.org/manual/Multiplication-Algorithms

GMP has lots of other methods in between schoolbook multiplication and FFT multiplication. A nice one is Karatsuba multiplication which is very easy to understand and delivers O(n^1.58) rather than O(n^2) performance. Python uses this method for multiplying large numbers together

https://en.wikipedia.org/wiki/Karatsuba_algorithm
Newer Western European developments tend to focus a lot on trees again in my experience. So there’s hope.
Having been on the reporting side, "an exploitable vulnerability" and "security weakness which could eventually result in an exploitable vulnerability" are two very different things. Bounties always get paid for the first category. Reports falling in the second category might even cause reputation/signal damage for a lack of proof of concept/exploitability.

There are almost always various weaknesses which do not become exploitable until and unless certain conditions are met. This also becomes evident in contests like Pwn2Own where multiple vulnerabilities are often chained to eventually take the device over and remain un-patched for years. Researchers often sit on such weaknesses for a long time to eventually maximize the impact.

Sad but that is how it is.
> A parent cannot fight a fight versus ten-twenty billion/trillion dollar companies

Of course they can. I won't buy my kids a Javelin from Raytheon, nor a smartphone with Facebook on. With or without laws stopping me.
Death of EDW (assuming you mean Enterprise Data Warehouse)?

I don't hear many people use the term EDW, but data warehouses (e.g. Snowflake) / data lakes (e.g. Databricks) are very much alive. It just takes more connectors and data engineering to get all your data there.

That's a big part of the reason we started Definite [0]. It's hard to pick all the right components to get a data warehouse, we make it simple (built in warehouse with all the connectors you need).

0 - https://www.definite.app/
these don't seem to be the common cases that matter today - big corps taking open source code and making big money off them without giving anything back to the community and instead occasionally hound at lone developers for timely fixes so they can keep on making the big money.
I believe knowing existing user name or using host-depended value does not matter.

The exploit tries to interrupt handlers that are being run due to login grace period timing out - so we are already at a point where authentication workflow has ended without passing all the credentials.

Plus, in the "Practice" section, they discuss using user name value as a way to manipulate memory at a certain address, so they want/need to control this value.
I think this is very naive. The whole reason marketing is so lucrative is because the human brain is so easily exploited. That exploitation is to no benefit of society or the individual and an individual practically stands no chance against it.

We also don't allow drugs to be distributed and marketed. There are many limitations to cigarette sales and they have shown to be successful.

Maybe the next thing someone sleepwalks into is a pleasant conversations with people or coding a great open source project and that is not something that needs to be fixed.
You are mistaken.

I bougth it, is not a lease, is not a license to use it, I own the device. I should be able to run whatever I want on it.

Stop spreading missinformation, you are thinking about software.
Nah, it is so bad, that on BUILD 2024, they have brought back first level status to WPF.

No one burned with WinRT history since Windows 8, is ever touching WinUI, unless they are Microsoft employees on WinDev, or companies with sunken costs trying to keep their products around.
> air being pushed down is actually a side-effect of the lift-creation process, not the cause of it

The turning of the gas is absolutely what causes lift. (Where the Newtonian explanation is misleading is in “neglect[ing] the physical reality that both the lower and upper surface of a wing contribute to the turning of a flow of gas” [1].

Put another way: if you know the mass and acceleration of the gas about the wing, you can calculate lift. (This is impractical for many reasons.)

> a wing in ground effect

VTOL aircraft also experience ground effect due to the fountain effect.

[1] https://www.grc.nasa.gov/www/k-12/VirtualAero/BottleRocket/a...
The Moon forming impact (4.5 Gyr) occurred ~100 million years after Earth's formation. The earliest solid grain comes from another ~100 million years after that (4.4 Gyr). The earliest signs of life (4.1 Gyr) are from ~300 million years after the earliest grain. Does not seem implausible that life could have arisen during the first 100 million years as well. We know very little about that era since the impact liquified the whole surface.
Would love to see them tear up highways and build forests and not the other way around
You missed out the input to the LLM, which would presumably be a requirements spec with all behaviour specified in exact detail, including all the tricky corner cases were someone has to think hard about which solution is most useful and least confusing to the customer. Natural language isn't great for expressing such things. A formal notation would be easier. Perhaps something that makes it easy to express if-this-then-that kinds of things. I wonder if a programming language would be good for that.
Theo de Raadt made an, I think, cogent observation about this bug and how to prevent similar ones: no signal handler should call any function that isn't a signal-safe syscall. The rationale is that, over time, it's too way easy for any transitive call (where it's not always clear that it can be reached in signal context) to pick up some call that isn't async signal safe.
Not OP but guessing: easier to build/test/debug in Chrome for starters, and if it gains traction try to fix cross-browser bugs. Especially if this is a 1 person show.
"It passed all the tests so it must be working, it must be something you are doing wrong"
This is a good post, and I agree with the "paranoid porgrammer" attitude being useful.

The post could also talk about yet another desirable paranoia, namely "Am I building the right thing?" - so talking to customers/clients/stakeholders/users is arguably one of the most important steps when seeking re-affirmation and controlling one's work. Nothing worse than people who think they understand a technical problem, but it's not the one that the customer wants solved...
Ubuntu isn't affected _by this exploit_
Did you click on that Cornell link?

> The term “used for commercial purposes” means the carriage of persons or property for any fare, fee, rate, charge or other consideration, or directly or indirectly in connection with any business, or other undertaking intended for profit.

Wait, "carriage"? Click on the source link and go up a level, and you'll see it's talking about transporting people and things in vehicles: https://www.law.cornell.edu/uscode/text/18/31. It's part of "18 U.S. Code Chapter 2 - AIRCRAFT AND MOTOR VEHICLES": https://www.law.cornell.edu/uscode/text/18/part-I/chapter-2.

This does not apply to software.
I suppose the question is: why bother with trust? Why not just "verify"?
Because of the negative lift of the horisontal stabilizer, the main wing needs to provide more lift than the weight of the airplane. This increased lift requires flying the wing at higher angle of attack, which always comes with increased drag (https://en.wikipedia.org/wiki/Lift-induced_drag). Increased drag means lower efficiency.

Analyzing energy transformation is not so useful, because most drag ultimately ends up heating the air. (A little will heat the airplane skin.) There are several different mechanisms that makes that happen, and no easy way to figure out how large it is, but it's definitely not minimal. It's why (most) airplanes need an engine to stay up...
So it's very likely that some young sysadmin or intern that will have to patch for this vuln was not even born when OpenBSD implemented the solution.
Doesn't that count as plain old fraud?
https://archive.ph/2jaWp
There are many laws against advertising cigarettes for instance. There could be similar laws against unhealthy foods and alcohol. Lets try all these things before we say laws are not effective against these things and evaluate after.

In smoking it has had a huge impact.
But then you're not giving your kids access to modern tools (photo, audio recording, translation etc.).

You're inserting yourself between them and their grand parents, close family etc. not letting them navigate a safe social circle.

You're closing their world and this is a different angle to blame.

PS: I am heavily biased, but in general I think we can give parents a break. Some of them must be shitty, but traditionally the rest of society has been the escape hatch in these situations. If we really think there's an issue, the first question should be why it's not solved at the social/systemic level. Putting kids in a cage and blaming parents can always be done at the very end, when all other solutions have been tried.
The starting of a war with allies is in contradiction with a desire to improve trade ties. If you remember, Nordstream, a product of trade freedom, was a point of leverage at the outset (until it wasn't). Hardly in the spirit of globalization. The idea that Russia wants a congenial and cooperative relationship, is laughable, not just due to the war, but also actions like poisoning political leaders. But I do agree that greater trade freedom for Russia would be good for Russia either way, but globalization has coded in it the gestalt of geopolitical stability — not what the current Russian leadership wants.
I trust the computer far more than the fellow humans. The computer will generally give a predictable output for a given input. "fellow humans in daily life" .... not so much.
Kind of an odd flex given how walkable San Francisco is, but the "risk adversity" is because people actually die. Last year, five people died from fallen trees in a single storm (two in the city).
Hazelnut on cities are mainly from two different species. Corylus avellana is clearly a shrub, even if can grow 6m high with time, and will recover fast from being chopped, but the other species is a tree.
In this [1] example GCC hoists, even in C mode, a potentially trapping division above a volatile store. If c=0 you get one less side effect than expected before UB (i.e. the division by zero trap). This is arguably a GCC bug if we agree on the new standard interpretation, but it does show that compilers do some unsafe time travelling transformations.

Hoisting the loop invariant div is an important optimization, but in this case I think the compiler could preserve both the optimization and the ordering of the side effects by loop-peeling.

[1] https://godbolt.org/z/ecsdrPa94
> I’m not sure what you’re talking about

I'll say it more bluntly, then. They were making a weird, stretched, assertion. Your question missed this/bought into it. Consider my first post a joke in poor medium/taste. Sarcasm doesn't translate well.

They confirmed one of your theories (and the one I felt comfortable going with/dismissing) in another comment; vaguely - amphetamines/stimulants.

My point is that it's none of the above. Viral things do better in 'the tropics' during viral seasons than broadly in the north. The drugs make one feel less of the debilitation. Truly ground breaking stuff.

It's a true mystery how communicable diseases do better in favorable and populated/traveled environments. Or how self-prescribing OTC 'analogues' may achieve similar effects. To be clear: /s

This is why I felt the question was silly. I hope that makes sense and clears up your confusion. I don't mean for this to be sour, or belabored... and yet.

This thread is unfounded/on the wrong track from the outset. Avoidable with a little bit of internalization for all three - the other, you, and me.
The cable/charger situation was worse in the pre-smartphone era. I remember two variants of Nokia, several for Sony/Ericsson and an even greater number for Samsung. Most phones had proprietary audio connectors too. People are now able to switch between all major smartphone brands without purchasing new cables or power supplies. If you wanted to, you could just use your USB-A power brick with a USB-A to USB-C cable.
I’ve been using the free tier of Gemini for exactly this, it can read and summarise YouTube videos by reading transcripts and the auto-generated CCs. Works really well!
Wait a minute, wasn’t ICQ shut down a few weeks ago? What have I missed?
"There are trees that have been around since before the invention of the telegraph"

There are trees, that are allmost 5000 years old, so around the time humans started building cities.

https://en.m.wikipedia.org/wiki/List_of_oldest_trees

The oldest tree in a city might be this one, 2300 years old, living history.

https://en.m.wikipedia.org/wiki/Jaya_Sri_Maha_Bodhi

Around here, they also plan to chop down a lot of trees that are around 200 years old, because the road repairs are cheaper with them gone. I hope it does not get to it as resistance is forming, but I might consider climbing and sitting there to block it.
You should browse the set of WinUI related repos, YouTube community calls and Developer Connection, feedback is something they aren't short of.
For an opposing view, look at what happened during the freeze in Austin, Texas for an example of policies that allow for minimal tree pruning.

It was a significant issue that caused the city an incredible amount of damage. Electric was shut down for days, cars were destroyed, houses had trees fall on them, etc.

Might still be worth it, but an interesting data point nonetheless.
the hard part for the individual is data collection; no matter what comes in the future it will likely start there.

start hoarding all of your data, comms, whatever can be digitized.
Why not just an LLM-based interpreter that direclty executes a PDF spec plus edits received by email? No need to recomplile and restart the app. A DB is also not required - the LLM will naturally remember all user requests and figure out the current state. (We'll solve the limitations of context later)
how did you get that pinterest-style layout?
Android Users Reaction to iOS 18 New Features [video]
I heard the same
For individual KOLs, cost savings can be achieved.
Can confirm, Pi OS bullseye also has the updated openssh.
Such an amount of connections should anyway trigger all possible logging & IDS systems, right?
I live there as well, and while I'm sure it could be worse, it's nothing compared to Johannesburg. I would like to see much more green throughout the city. Hopefully they will keep up the trend.
I wonder if there's a AI trained on pirated data.
If only UWP had a AOT compilation story for .NET code that could be re-used for WinUI 3.0....

And then there is the whole C# / C++ interop between CsWinRT and C++/WinRT.
Johannesburg is the largest man-made urban forest and Tijuca forest in Rio is the largest urban forest.

https://en.wikipedia.org/wiki/Urban_forest
Yes, having control of your data is safer.

Even if the supplier disappears, it is possible to quickly switch to another platform
> I don't disagree with anything you say but try telling my 16 year old daughter she need to jettison any form of social media and go with the nerd crowd.

There exist quite some other groups of people who reject social media: I just chose the "nerd crowd" example because many HN readers are very familiar with it. For example

- people who are somewhat skeptical about technology

- people who are "anti establishment"/"anti big tech")

- ...

I can easily imagine that if "(mostly) everybody" uses social media, a pubescent girl might easily come to the decision to reject social media completely just to be annoying to other people, and tell them to f... off.
x/0 is not reached if the printf blocks forever, exits or return via an exceptional path (longjmp in C, exceptions in C++). Now specifically standard printf won't longjmp or exit (but glibc one can), but it still can block forever, so the compiler in practice can't hoist UB over opaque function calls.

edit: this is in addition to the guarantees with regard to side effects that uecker says the C standard provides.
Snaplet Is Shutting Down
That's a legal definition of "used for commercial purposes" for vehicles: https://www.law.cornell.edu/uscode/text/18/31, https://www.law.cornell.edu/uscode/text/18/part-I/chapter-2
The project will most probably be reactivated. To think that a govt will forgo that kind of income (and control - all those cameras and LP reads) is unrealistic. A year from now it'll be up and running. In fact, it actually might be running already, just not charging. This is quite common in the tolling world, to run a few billing cycles at first without sending out invoices.
By "not that I want to" I pretty much mean that I never bought land or housing as a financial investment but it turned out to have a substantial increase in value; likely to be realised by children | grandchildren if they sell.

The value to me is a rear granny flat I can stay in for free | lend out to friends in the capital on a block with a house I got a kick out of rebuilding and now rent out at discount rates to students, etc. and rural land about the state, some near the ocean, that pays it's own way and can be lived on as I move about.
Do you use anything for emails?
That poor middle manager who will take the fall and get sent to prison
If Newton’s third law sufficed, then the shape of the upper surface of the wing wouldn’t be important. In fact, it matters a lot.

There is no single explanation for why airfoils generate lift that works at a grade school level.
The qualifier is "along a streamline".
There are efficiency races for general aviation aircraft, yes. Check out https://en.wikipedia.org/wiki/CAFE_Foundation
Actually I find it much easier to write C++/CLI, than getting right all P/Invoke marshaling, specially if COM is also part of the picture.

Also C++/CLI can also generate native code when specific code patters are used, that is why there are some compiler flags to disable it, and such assemblies are considered unsafe.
The lovely web browser folks added columns to CSS a few years ago (https://developer.mozilla.org/en-US/docs/Web/CSS/columns).

The Scroll theme took many months of tweaking, but now columns seem to work pretty well.
Dub is a great URL shortening tool, but its deployment is more complicated and relies on multiple platforms.

So I simplified it. Currently only relying on one platform.
When did that happen? It's gone from science to pure aesthetics. I wouldn't label it "art", it's merely vibes based.

Read design books from the 1980s versus today. They aren't the same planet.
> but also believes it is probably necessary to know the structure to understand the biology in the future

I don't agree. Biology is really about systems - complex networks of biological interactions. The physically structure of it's components aren't required to understand those interactions at the system level if you can simply measure the interaction directly ( rather than trying to predict it poorly from a structure ).
I'd imagine most translators would first start with a google translate and iterate from there anyway. I know I would if it was text.
I doubt most servers use any such thing.
I'm asking because even after reading the piece[0] it's not clear.

There's no data on how "often" the clothes are soiled garbage, how does this whole value chain work, who is paying for what, and so on. But of course there's a call for AI investment to sort the threads/fibers. WTF.

Nominally the text beings by talking about this trade agreement (AGOA) which is set to expire in 2025, and then just completely nosedives into bullshit.

The only datapoint is that there was an attempt to ban import - which presumably was a violation of the agreement anyway - then the fascist monkey administration started throwing shit.

Protectionism for protectionism's sake is bad. I recommend this recently released interview with Anne Krueger, who did the study on rent-seeking in 1974 (which demonstrated how the whole import licensing was nothing more than very expensive legalized smuggling).

Yet the world is also getting more complex, and externalities are important. Like waste, dumping, or market-distorting subsidies (as on Chinese EVs). Hence tariffs on imports have their place.

[0] https://archive.is/ten3W

[1] https://www.mercatus.org/ideasofindia/anne-krueger-reflects-...