skysight-inc/HackerNews huggingface dataset:
API based credentials are just username + password in this context, nothing else seems to be restricting access to data. So if your Snowflake tenant isn't enforcing IP restriction to limit source auth attempts, those creds can be used to pull the data from any source IP.

Even then, you'll still have an HTTP 403 response layer filtering those auth attempts based on IP... where we can assume these failed to implement it.

So far between TechCrunch, Wired, and other reporting it seems most claim creds get owned, sold, then used against under-restrictive Snowflake tenants which are exposed by default.

i.e; https://epa06486.snowflakecomputing.com/console/login#/ here's someone's tenant, if you were able to go buy some creds for it, should walk right in.

[edit] I have a more detailed Snowflake comment with references that might fill in better gaps here; https://news.ycombinator.com/item?id=40554753
I was a skeptic after all the hype around Blockchain, Virtual Reality, and other technologies over the last few years. However, I have to say I find AI impressive. Compared to the other things I mentioned, I see cool new products and solutions popping up every week that add real value to my personal and professional life. ChatGPT alone saves me at least 10 hours of work every week, with more savings all the time.
The White House Creator Economy Conference
This site does some shadows on the links that makes them unreadable with dark mode extensions.
In the early 80's home computers were a technology of faith. Many thought it was absurd that many people would want computers in their home.
Maybe this is what it'll take to seriously combat global warming. Filling zoos with wooly mammoths, and then extorting us into dropping global temperatures to keep them alive.

Unless we're headed for a Day After Tomorrow situation. Then it might be the mammoths keeping us in zoos
The end of my frontend fatigue was to get away from Javascript and it's doctrine of churn.
Needs to be at the level of enforcement by regulatory agencies, large scale lawsuits backed by state governments, and maybe even congressional action

These companies have scale as their moat and that's called a monopoly. We need to be aggressively pursuing corporate malfeasance, closing loopholes, and breaking up companies. In my ideal world the entire doctrine of the "corporate veil" would be overturned, but that seems unlikely to happen without drastic upheaval. Antitrust action and large-scale suits can happen and to some degree those wheels are already in motion, but it would help a lot to stop buying this bullshit about how we should think of this as a "crime" for which we should uniquely blame hackers. These megacorps want to pretend that they and their customers are in solidarity as victims of the hackers. In reality, these companies get hit with essentially none of the consequences, and their practices are most of the relevant causal factors. A better model would be that the customers (and often non-customers on whom they collect data without even the figleaf of manufactured consent) are victims of the companies and the hackers
Italian Air Force eyes Airbus tankers after dropping Boeing planes
>Most US Gov agencies are underfunded

Doesn't the US outspend in terms of dollars almost every single developed country on the planet at absolutely everything, even in per capita statistics, from military, police to education and healthcare? How could it be underfunded?
VTI in my IRA, FXAIX (S&P 500) in my 401k.
Honestly, that's the way to do it. Let them know that you'll sell the debt to someone that is able to screw up their credit.
Ooooh, this is interesting. I think I'm building something quite similar! May I ask, how do you solve the code modification problem? In your demo video it shows the AI prompt is modifying code, not just generating it first-time, but I am curious how you do it. Are you using diffs?

I wrote about my approach here using ASTs: https://www.codeplusequalsai.com/static/blog/prompting_llms_...

You wrote in your post that you 'regenerate' a file - is that how you do it? Is it reliable? How does that work on big files? Does it fail at reproducing the rest of the file that should remain unchanged sometimes?

Thanks for answering any of these! Great project!
It's honest. I'm not trying to hide my bias.

The rest of the response though attempts to "both-sides" the issue. The reality is that NIMBYs are wrong. That's just a fact of nature.
The wildest part of this excellent software is that you can feed it WAV files of tape-recorded BASIC programs and it can decipher them.
Can protein models help cure prion diseases?
On the one hand, yes.

On the other hand, a 15 months old token that's still alive... that's pretty damn incompetent.
Prescription NSAIDs are one of the top 2-3 causes of adverse drug event hospitalizations in the US. Patients on opioids and NSAIDs lead to the highest rate of 10 day admissions. There is insufficient data capture of OTC drugs to factor them into this stat, I believe.
> For the smart-phone too, one of the "issues of now" was slow cellular connectivity

Nobody said "you have to buy an iPhone NOW, because in 3 years the connectivity will be good". When Steve Jobs got on that stage to show it off, he didn't ask you to trust his vision. He didn't promise you what it would do tomorrow. The sales pitch was simple, It's an iPod, a Phone, and a web browser, and importantly it did all those things. He sold it in the NOW. all that other stuff that phones became, that came later. The iPhone was first and foremost a good product in the now.
The threads have probably tripped the flamewar detector. Certain amount of comments plus some other metrics will hide the thread from the front page.
It might mean 20% more neutrinos exist than we think. That would change the total mass of neutrinos.

Much more interesting (and not touched on by the article as far as I noticed): The electron neutrino is the "partner" to the electron. The muon neutrino is the partner to the muon, and the tau neutrino to the tau. What's the sterile neutrino the partner to? (Or doesn't it have one, and that's what makes it "sterile"?)

If there is a partner to it, does the partner have mass? Does it interact in any way besides gravitationally? If not...
I think the problem is that Twitter's definition of "verified" - and the one Twitter's users relied on - was only meaningful for "notable" persons to begin with, i.e. persons with some kind of public record.

The core problem they wanted to solve was "if a user encounters an account that calls itself 'JustinBieber' how can the user determine whether or not they got the real Justin Bieber, i.e. the singer, or just some other random account". So what the badge in effect was supposed to communicate was "The person behind this account really is who you think it is".

It's easy to see that this entire concept falls apart for anyone who isn't a global celebrity: What does "the real Justin Bieber" even mean? Would another, not famous person that happens to also be named "Justin Bieber" not be "real"? What about account names that don't even match a celebrity but where their fans "just know" who is meant? What does "real" mean for the account of a fictional character? Or for a random nondescript username? etc.

Twitter management effectively saw all those contradictions and said "we don't care", as long as their prime usecase of keeping celebrities on the platform was served.
I really appreciate your help, thanks!
Yuri says hi :) https://imgur.com/a/LfDttO9
That's why I consider writing any secrets into code base a security malpractice.
Just for a minute or I am sure I won't commit it, is not an excuse.

Use environment variables or better yet - store the secret on the disk outside of your repo and make the code read it. It's a one liner in plenty of languages.
>Where are the flying cars?

Apparently you can put $150 down on your flying car preorder now (only $299,999 final price).

https://alef.aero/preorder.html
ATT could be using Snowflake for internal analytics
That's essentially what it costs to have the police do the work for you, not what it costs to have the work done in general.
Straight from Adobe's website: https://developer.adobe.com/document-services/docs/assets/5b...

EDIT: If it's important that it's the actual standardized version rather than the final draft then you can get it for free here: https://www.pdfa-inc.org/product/iso-32000-2-pdf-2-0-bundle-...

(Strictly speaking it's the 2020 revision which incorporates some errata. I don't know if the final standardized 2017 version was made freely available)
Style Queries Are Almost Like Mixins (But Mixins Would Be Better)
The problem Boeing had was that there is a massive amount of 737:s, and a correspondingly massive pool of crew qualified for those planes. Customers really wanted not just a plane that was compatible with something, but specifically compatible with the 737. And this was a problem because the 737 is too old of a design.

If Boeing attempted to sell these customers a new type, even if there is some compatibility with some other plane, it creates an opportunity for them to freely compete bids between Airbus and Boeing, and even when Boeing wins that bid, it's a loss to them. (Because they are going to win at a lower price point than if the customer has to account for the switchover cost only for Airbus planes.)
Narcissism Across Life Span: Meta-Analytic Review of Longitudinal Studies [pdf]
Sometimes, it's hard to tell how significant something is, and the creators may not even know until hindsight, let alone articulate it in a concise, accessible way.

The initial marketing word usage such as "amazing" put me off at first ("Show me, don't tell me"), as well as how the author(s) poo-poo'ed on Kubernetes. (I've worked on both good and bad usage of K8S, so it isn't always a fairy tale, nor with a bad ending). However, it also read like someone who seemed to have a deeper understanding of infra writing about this, not just a vapid reinvention by someone who works mostly on the front-end, so I kept going with the README.

Having said that, while I am a big fan of IPFS, I know there are performance issues with it. (Maybe Tau set up a private IPFS that is only used within the cluster, which may help it work faster). It also sounds like they are working on general container support, not just Webassembly. Overall, if they keep iterating and improving things based on how things work in production, then they'll end up with a fairly robust system.
May be interested in https://news.ycombinator.com/item?id=40766684
Overland AI
Or a biro? Don't they work by capillary action rather than gravity?
I loved security training at Microsoft.

I remember one time Satya said the red teams reported to him which Microsoft services they were currently in. He would then ask the heads of those services if they had detected any breaches. Sometimes there would be services that had been breached for years, undetected. Must have been hard for Satya to keep a straight face.

One phrase that struck with me from their security training: "Assume Breach".
Cosmic Desktop Close to Alpha Release, Adds Compositor Multi-Threading
I can rephrase, but that wasn't a strawman argument.

You're citing the general life's works of Matt Taibi as proof of your original claim, that sophisticated soviets are behind the OP story.

What precise item of Matt Taibi's corpus would you like to cite, to back up your claims?

I don't think pointing me to a three hour youtube video is a good response.
A compiler is a combinatorial optimizer (think bin-packing). In general, optimizers/solvers basically search for the best solution. Most production compilers don't have solvers in them, they use heuristics instead, but even the best solvers use tons of heuristics. Naturally a computer will search/try heuristics faster and more thoroughly than you but sometimes you can do better because performant searching is all about "knowing where to look".
Pleistocene Park and albedo. I don't think you've got this exactly right, it's about grassland, not forest. Also forest is supposedly bad for permafrost, raising temperature slightly.

> Pleistocene Park is a truly fascinating and daring experiment in the far Arctic, in Siberia, run by the Zimovs, Sergey and Nikita Zimov, a father and son scientific team, and their families. And they have this theory that large megafauna in the Pleistocene, things like mammoths and mastodons and bison, these large grazing animals, co-evolved with the grasslands that existed at the time. And so the grazers and the grasses maintained and sustained each other.

> These large animals would trample the trees and shrubs that would otherwise compete with grass, and the grass would provide these grazers with this rapidly regenerating vegetation that they could continually graze on. But it went further than that in their estimation, because, together, the grasses and the grazers, according to their theory, were helping to keep the permafrost frozen.

> So, for example, the grazers, just by being so large and by walking through these grasslands, were stripping away these insulating layers of snow, which allowed these frigid temperatures to penetrate deeper and keep that permafrost frozen. And grasses, just by virtue of being lighter, paler in color than trees, reflect more light and heat back to space. So they’re also keeping the land cooler. And so their idea is to bring back large grazing animals to Siberia, to recreate some version of these ancient Pleistocene grasslands, and thereby counteract the thawing of permafrost to some extent.
The same EU that doesn’t allow any public agencies to collect statistical data that goes against their narrative in social sensitive areas, is now threatening to fine a private company because they don’t provide them access to their engagement and advertisement data.

The hypocrisy.
I doubt they "breeched the cloud service" provider. They almost certainly exploited no 2fa controls on the clients access via the clients network, which is what GP was saying. If you're on a businesses network it's too easy to get at their cloud storage or dbs because they should be on a secure overlay network.
IIRC from reading Showstopper, NT was intended to afford that sort of different frontend swapping. It just happened that Windows became the primary focus in the end.
You're running the latest version of the app too, right?
I think it’s consistent to find AI overhyped while still believing it to have some value.
Cosmic Updates (Feat. Community)
And, the first iPhone worked really, really well over WIFI.

It was good enough in the NOW, even though it didn't have an app store!

Edit: I should also add that I was a "late" adopter of the first iPhone. I didn't rush out and buy it the day it came out. I tried it in a store and made sure the web browser was useful. After a few months after hearing (almost) no complaints, when my phone has issues, I went out and bought one.
Was any operating system actually able to go from single-user to multi-user so easily? Windows NT and OS X were totally rewritten from the ground up relative to their single-user predecessors Windows 9x and classic Mac OS.
Just for balance, here's 84 examples of the opposite: https://www.theverge.com/2019/12/20/21029499/decade-fails-fl...
Metadata can be identifying enough. For example, given someone has this data and some local LLaMa variant on their machine, they could theoretically run a query like: "Give me all of the people that $NAME have called to, sorted by the number of times they called each other"
70/30 VTI VXUS?
> Did you know that AT&T has a commercial product where they sell Metadata of websites visited (unclear if it's only Netflow or if it includes DNS lookups too) to law enforcement

Do you think that only AT&T does it ? Welcome to democracy, my friend. /s
Every critique of AI assumes to some degree that contemporary implementations will not, or cannot, be improved upon.
-Ximm's Law
They are using technologies such that the system can self-heal, and self-deploy (with auto discovery) ... so there's a misalignment of incentives for the product and a hosting business.

I like the ideas they are trying, so I wish the best of luck to them. Hopefully, they'll find a business model that is better aligned with the product.
But the results looks... very bad?
I wouldn't volunteer to be the first guy to try that out.
No doubt! I err on the side of "most things are over-hyped" (see: room temp superconductor hype that lasted a week), but I try to remind myself there's a yin and yang thing going on.

Yin: "this tech will change the future"

Yang: "this is over-hyped and the promises are hot air"

It's easy to default to "yang" because it is true most of the time (especially with tech). But you gotta acknowledge that "yin" is actually right some times too.

Nuance, man, it'll get you every time.
Agreed, I remember having to vendor runtimes to my services because we couldn't risk upgrading the system installed versions with the number of things running on the box, which then led into horrible hacks with LD_PRELOAD to workaround a mixture of OS / glibc version's in the fleet. Adding another replica of anything was a pain.

Now I don't have to care what OS the host is running, or what dependencies are installed, and adding replicas is either automatic or editing a number in a config file.

Containerization and orchestration tools like k8s have made life so much easier.
Yep. Have exchanged emails with Oscar Merry(sp?) about it many times starting from when it was first announced as part of Podcasting 2.0 but the features and layout of AntennaPod are hands-down better. As long as I'm on iOS I'll probably stay with Overcast but I have been using Podcast Addict as well.
It’s a cloud database, mostly olap. The ATT account was secured with a bad password and no mfa.
Interix was so much more orthogonal to the design of NT-- so much more elegant. WSLv1 was more elegant than WSLv2. WSLv2 feels like a minor step up from just running a Linux VM.
>It's an iPod, a Phone, and a web browser, and importantly it did all those things. He sold it in the NOW.

I think this is really important because it shows that the vendor knows they're meeting a real demand NOW. They're not selling hype, early access, and woo-woo future-talk in hopes of maybe eventually finding a problem for their solution.
Empiricism is certainly an epistemic paradigm, but am I right in understanding that you only derive knowledge through empiricism? I find that hard to believe. Can you explain?
Goldman Sachs: AI Is overhyped, expensive, and unreliable
What? Has anyone published an RCA that confirms this? Is this how the data was ex filtrated from Snowflake? Or did ATT’s Snowflake credentials leak?
Private companies get breached often too (see AT&T).

Pretty much everyone gets breached.

The only ones I don't think get breached deep are the really big software engineering companies where most of the company are also software engineers... like Google.

Software is too complex to be secure without a massive team IMO.
Yeah, this layout of a linked list within one big allocation seems like a niche thing at best.

* I tend to default to a simple vector because it's denser, more CPU cache friendly, less pointer chasy.

* If I really wanted a linked list to avoid occasional expensive ops, I probably would want to be able to grow it without reallocation (much less touching up all the old pointers), so they might all be in separate allocations, and most general-purpose memory allocators won't give me the nice sequential-ness.

* And then I'd probably end up with an unrolled linked list (probably the same thing you're describing as a "segmented array"?), which would reduce the pointer chasing and also make better use of the memory bandwidth through better density, so it'd outperform this trick.

* I guess if I really wanted to be able to reorder stuff within a vector cheaply but was still comfortable with the amortized constant time for growth, I might have represent the links as indices within the vector (or in a parallel vector). It'd be useful then. Maybe something like a linked hash map too. But if those ops are common, the 100% accurate prediction of this benchmark is way too optimistic. Could sort it sometimes as you mentioned, but that seems even more niche and fussy.

There might be other cases of this trick that I'm more likely to use than this data structure, but I'm scratching my head to think of them.
AI is a machine that can creates more than what you put in. That is "value creation" by definition.

If you've used AI, you know it's a massive timesaver. I find a lot of those who are skeptical haven't used it very much.
there is a prior product/service of that moniker.

will the real rufus please stand up.

Create bootable USB drives the easy way
https://rufus.ie/en/
But they aren't brighter...
This sounds like China Miéville.
Being verified made you trustworthy in the sense that it signified that Twitter trusted the account. If you trusted Twitter, then you could sort of infer a kind of trust relationship with that account, in that it was trusted by an authority you trust.

Getting verified was just a popularity/insider contacts game, for sure. But now that trust relationship is sort of up for grabs, and there are a litany of people who (at a glance) will trust accounts with that mark if they see posts from them. This is ripe for exploitation by bad actors.
Techno-utopianism requires a new & different Awesome New Technologies every few years - once people start to realize that the previous ANT ain't gonna take us to the Promised Land after all. Just like the previoius ANT didn't, and the one before that didn't, and the one before...

On the bright side - at least they aren't trying to sell us on the idea of nuclear-powered cars, or commuting via rocket-belt anymore.
Agree, good point, the overlay needs to do strong identity, authN, authZ.

The critical part the overlay adds to traditional auth is making the server unreachable from the underlay networks, reducing attack surface by billions. Meaning:

+ Let's say the server did have good auth, but there was a bug, misconfig, zero day, etc. (one of the myriads of proximate causes).

+ Since the server is available on the underlay network, that vulnerability can be exploited by anyone on the underlay (billions Internet nodes).

+ In contrast, making the server only available on the overlay, reduces the attack surface from billions of Internet nodes to the nodes which can ID, authN and authZ (for that particular server) on the overlay.
I assume in most jurisdictions reasonable enforcement costs would just be added on top of the debt, so that’s not really a problem.
> but nothing prevents programs from editing their own code as they're running

On some platforms writing to memory mapped in with PROT_EXEC will trigger a page fault and the process will be killed. In other words, self modifying executables are effectively forbidden by design (the workaround is to unmap the memory, map it as PROT_WRITE, modify, unmap, map it in as PROT_EXEC, and resume execution - which is what JITs do on MacOS, for example).
I will never buy an Android TV again after a horrible experience with a high-end Sony TV. It was extraordinarily laggy. Even changing the volume was a nightmare. Quite possibly the worst UI experience ever.

Pro-tip: Go with higher-end LG OLEDs. They are fantastic, super fast, and designed for cinephiles. You can often get "certified excellent" open-box deals at Best Buy for a very reasonable price. They're equivalent to brand new.

People on Hacker News love to complain about ads. I hate them too, and go to great lengths to block them. To be clear, they're referring to the "suggested content" on the Home screen, which I'm not sure many people use. Either way, all of that is easily disabled in the settings.

If used with an Apple TV, set top box, or, best of all, 4K Blu-ray, it's a premium experience where you're in control of all the picture settings.

Check out @hdtvtest on YouTube for in-depth dives.
Can ChatGPT Pass a Theory of Computing Course?
Flying the Brand New PC-24 Jet in the Swiss Alps [video]
Getting people to think about disaster recovery