skysight-inc/HackerNews huggingface dataset:
Another great post by Simon.

I literally built this concept into my new project last night, because I wanted to add evidence to the story about the Google Gemini App moderating yt-dlp, by showing that the Gemini API does not. Also to enable a funnel to the project and the other business-y reasons Simon outlines.

https://topicalsource.dev/chat/84a0d6dd-f66f-4f12-af17-5e99c...

The other thing I did was use localStorage to keep a list of public chats you've visited, so that when you come back you can see the other chats you have read. Also easier lookup than trying to find wherever you may have gotten the original link from. (like scrolling back in text history)
I think GP is suggesting an insider could introduce a bug, have a confederate "find" it, and split the money. At $5m I think more than a few big tech employees might decide to write themselves a new minivan.
I live in the US and am constantly disappointed by the fact that I have to pay extra to add onions to my Taco Bell burrito or lettuce and tomato to a McDouble (typically when on a road trip with friends). As it turns out this might be attributable to companies optimizing for consumers' dollars instead of flavor preferences [1]:

> “They liked flavorful foods like turkey tetrazzini, but only at first; they quickly grew tired of them. On the other hand, mundane foods like white bread would never get them too excited, but they could eat lots and lots of it without feeling they’d had enough.”

> This contradiction is known as “sensory-specific satiety.” In lay terms, it is the tendency for big, distinct flavors to overwhelm the brain, which responds by depressing your desire to have more.

It probably also has something to do with the fact that people often equate "vegetables" with unseasoned, boiled slop like spinach and broccoli instead of more delicious preparations like grilling, broiling, roasting, or sauteeing with a liberal amount of seasoning. Brussels sprouts, for instance, are incredible when broiled and tossed with olive oil (or, even better, bacon fat!) and carmelized onions but are nigh-inedible if scooped out of a stock pot full of hot tap water.

[1] https://www.nytimes.com/2013/02/24/magazine/the-extraordinar...
I am genuinely surprised that these have been and continue to be so low. Do not know why but I was under the impression, that we had already gotten into the 1 Million USD range. While I do not know how much an interested party would realistically pay for an exploit that enables the complete takeover or even just limited access to a Gmail/Google account, I am pretty sure it has to be an order (perhaps even orders) of magnitude more than 75k.

Looked into it and am equally surprised to find that others, like Microsoft [0] also have such low bounties for these types of attacks.

While providing such an exploit to the affected company has value beyond the bounty (potential job offers, media exposure, credibility, ethical considerations, etc.), weighing that up against life-changing money really makes it hard to fault those who take the more lucrative route of selling these to the highest bidder, whoever that may be.

Seriously, Alphabet and Co. can afford more, especially considering any such exploit would most certainly hit their bottom line/stock far beyond a few 100k.

[0] https://www.microsoft.com/en-us/msrc/bounty
I think this may be what you are looking for: https://github.com/nim-lang/Nim/blob/devel/changelog.md
They don’t.

https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headline...
I'd expect getting involved with bad people would lead to bad outcomes. The "must tie up any loose ends" trope. Too many movies?
It’s not exhaustive/definitive yet (should be for the actual release), but this might be helpful:

https://github.com/nim-lang/Nim/blob/devel/changelog.md
The sad thing is, whenever I would land back in the UK for a visit I would always go straight to a KFC and grab a British Zinger because they were so much better than anything sold at the American restaurants.
We will know AGI is here when an agent can autonomously claim these bounties.
Look at the numbers and it's not so crazy. This is a last mile issue, not a full grid issue.
hold AT&T responsible. their officers. prison time. or this kind of carelessness with millions of people's lives will keep on happening if officers get million dollar paychecks they must also risk criminal penalties to balance out
It's hard to have the code compile after literally every single snippet. Sometimes, we need to change the signature of a function that already exists and is called, so there's going to be at least two snippets you'll have to apply before you're back to a working state.

It probably would have been possible to make this work by introducing temporary scaffolding code which gets removed shortly after, but it would have made the book much longer and more tedious.

Balancing thoroughness and brevity is always a challenge when writing.

The code is compilable at the end of every chapter and usually compilable at the end of every heading within a chapter. One thing I could have done that I didn't would be to place some visual markers in the book whenever you reach a point where things should be compilable. I'll keep that in mind if I write a third book.
Houston is having some budget issues currently:
<https://abc13.com/houston-budget-mayor-john-whitmire-city-se...>

How much should the states bail out mismanaged cities? How much should the Federal Government bail out mismanaged states? Budgets aren't "free money" as you assert.
Seems like slack has a problem

Maybe a dumping tool that uses a stolen api key? Rate limiting and monitoring on slack’s part could help…
Some questionable choices are made in this optimization.

The reason for the optimization is that there is so much IO activity the RAID checks can't complete.

It is unclear from the article if the RAID checks were ever completed on 17TiB of data. Instead, they choose to disable the periodic RAID checks and instead switch to doing the error checking as a page of data is read in. The two are not equivalent, and both should be used for important data.

Finding corrupt data only as you try to read it can lead to long running data corruptions, maybe to the point your backups do not go back far enough to restore the uncorrupted data. Underpinning this also is a change to RAID 0... While the fastest option, they are putting a lot of faith in that NVMe config handling that kind of workload.

Hope they have good backups...

EDIT: A good way to solve this is to spin up a temporary server, restore your backups to it, do the full data checks and when successful, you have also checked your backup and restore process along with the integrity of the file.
You still want to have enough overhead available to complete the RAID checks on the primary server and don't use RAID 0 for performance.
The economics of bug bounties from a “bug hunters” perspective are quite interesting! I’m going to give the short version.

There are public (such as the one being discussed here) and private programs.

To gain access to private programs you have to be invited to participate - you get an invite usually based on reputation for providing good reports on public programs.

Platforms like H1 and BugCrowd act as intermediaries for this, with reputation scores, etc.

It should also be noted here that if you rediscover a bug someone else reported, you don’t usually get paid.

With public BBP/VRP, you are competing against everyone in the space against a relatively limited subset of targets. The way to “win” is to either “go deep” against high payout targets, expending a lot of effort in the hopes of avoiding a duplicate finding, or to invest heavily in automation, or some combination of the above.

With private programs you are competing against many less people and have a higher probability of payout for time/effort expended.

The guys who tend to make a shitload of money off BBP/VRP either are focused solely on a handful of high payout targets, or have invested heavily in automation to grind public programs, gain invites to private ones, and repeat.

A lot of the better offerings in the “continuous vuln scanning” or “attack surface monitoring” market are from people who have been “full time” bounty hunters for a while, built out significant automation platforms, and pivoted to offering it as SaaS products to enterprise for detection of issues.

There’s a lot more to it, but it’s probably worth a blog post at some point tbh.

In my own experience, as someone who has participated in bug bounties and vuln disclosure programmes in my free time for about a decade now, I usually land a couple of nice payouts per year and a lot of issues reported without payment.
I personally know at least one normally functioning person that didn't claim their $1k bounty due to the complexity of that process (also bureaucracy).

Fortunately this is not a problem for me, because I couldn't find anything even if I wanted.
I beat you by 39 seconds! Hah! :-)
Can someone explain why hackers dump the files publicly rather than just tell the victim they got access? What's the point?
> Also Bob Nystrum has some other good material on his blog, and a chapter in game programming patterns about PL stuff.

Links:

https://journal.stuffwithstuff.com/

https://gameprogrammingpatterns.com/bytecode.html
You're making a bit of an assumption that the black market won't simply adjust to incentivize darkening the hat.
There are quite a few "legit" exploit resellers who will gladly pay millions for exploits and report the income to the IRS. They seem to do fine legally so long as their primary customers are govt or quasi-govt agencies. Now, if you decided to sell to an embargoed country I'm sure they'd suddenly declare the exploits munitions and try to lock you up for a long time.
There are multiple kind of problems.

One of these is that they use your power, and waste your network bandwidth, to try to force to display them and to track you and other stuff. Their use of your power in this way is like theft; they are stealing your power for their own use (even though such theft is not being done directly).

Although you could (at least sometimes) block them, they often make it unnecessarily inefficient and difficult.

Other problems include both A and B above, but these are separate problems. There are additional problems as well, such as deceptive advertising, and others. (TV shows that display advertising within the show is also a problem, but again that is a separate problem than any of the above.)
techno-anarchism
These are quite clever. I'd love to have my own Borromean Box.

That said, I've no clue how to start. It looks simple at first, but seems more complex the more I think about it. Some construction details, videos, or other hints would be much appreciated.
It's not worth it. Payout by default is at least 90+ days (or 3 months) after disclosure (this is standard operating procedure to give company time to fix vulnerability). Then some companies have some bullshit internal company procedure for payout ("only at the end of the quarter"). Some companies dangle the carrot of "higher payouts" but after an internal review by some fresh out of college, security bootcamp asshole. The committee downgrades it to a less severe vulnerability (ie, fuck you).

The number of clueless individuals running these bug bounty programs is not worth it. The only reason most people do it is for the "fame" within the security community; or that occasional researcher that was just bored.

Even worse, some companies (like South Korean companies) will not even pay out if you are not a citizen of the country. Makes no sense to me.
Flarum is a really nice open source forum

https://flarum.org/
I hope in the future we have more of flutter and flutter like frameworks and less of the web, it'd be a little more cost effective as it'd reduce server costs and it'd lessen the effect of cloud companies on climate change.
That used to be Computer Associates, now CA Technologies, owned by Broadcom:

<https://en.wikipedia.org/wiki/CA_Technologies>

"Where technology goes to die" was the verbatim description I'd heard of it directly from someone whose former startup had been acquired by them. That's a reasonably widely-held reputation:

<https://www.theregister.com/2018/07/12/broadcom_ca_technolog...>
Phontic Sneeze Reflex
> Inspired by archaeological discoveries in Amarna in Egypt, Freud posited that the monotheism of Moses was, in fact, of Egyptian origin: an evolution of the worship of the sun god, Aten. Even more scandalously, he asserted that ancient Jews had murdered Moses and perpetuated this monotheistic faith not from religious devotion, but from an unconscious sense of unresolved spiritual guilt.

I wonder how much of that had to do with the Nazi demonization and dehumanization of Jewish people. Monotheism is one of the big contributions to culture by Judaism. The other 2 major modern monotheistic religions- Christianity and Islam are explicitly based on Jewish monotheism.

Framing this as them stealing it from the Egyptians and killing Moses (similar to Jesus) seems very inline with what the Nazis would want to portray.
1 in 10 people infected during pregnancy develop long Covid, study finds
hello,

as always ... imho (!)

disclaimer: i'm a big fan of ldap, especially of the FOSS openldap implementation and i'm using it since ... ever ... (~ 25 years)

i think there is one feature which makes openldap stand out and which in my experience is crucial for any non-trivial directory-implementation someone wants to use:

* easy replication-setups with the possibility to create complex (!) topologies.

what i mean with that is maybe best described by the following "anecdote":

once upon a time i had the use-case of the migration of some mid-sized HPC-clusters - distributed memory - from "good old" NIS to LDAP.

ok ... sounds simple: pam-ldap and be done with it!!

sure, but what happens, if the LDAP main server fails!?

no problem, replicate to a second system as a "fail over" eg. HA ...

sure, but what happens if the network between the HPC-cluster and the LDAP server(s) fails!?

just replicate the directory "read only" to the head-nodes ...

sure, but what happens if the network "in cluster" fails!?

just replicate it to each node ...

now draw out the resulting topology ;))

why? because i wanted to keep the cluster(nodes) utilized even if the "worst case" happens.

last but not least: "openldap is a monster" ... sure, but define monster ... in my experience once you "groked" ldap and delved into the somewhat complex setup of openldap it "just works(tm)" ...

but: great project ... :+1: ... and its written in rust ... yawns ... ;)

just my 0.02€
It all changed when "normal people" started using computers. 1 KB = 1024 bytes makes perfect sense except to 98% of the world.
IMO NK in the unfortunate geographic situation where Kim's inherited the half of the peninsula with just not enough ariable land, but not so not enough that juche isn't viable. NK with water access could probably be an alright middle (or even upper middle) income country exporting their 5-10T mineral reserves. They had enough prexisting/rebuilt industry to perhaps even export higher value processed goods + not unserious effort at socialism to avoid dutch disease. Kims playing a solid hand poorly, but the cards are still enough not to fold. Which is sad.
https://archive.ph/Bakj1
> I understand the need to work with Google and Meta.

I confess that I don't understand a need for them to work with Meta. What does anyone but Meta gain by adding this feature? A quick search doesn't show that Mozilla gets significant financial support from Meta (although maybe that's just bad searching on my part). If not money, what does Mozilla gain from this? Goodwill and a hearty thanks?
welcome to a post 9/11 world. privacy has been dying for a long time. the general population doesn't care anymore. they freely give up everything to big tech anyways.
Unless I’m misreading, OP themselves didn’t actually say Rust at all. They just noted that Ladybird is written in an unsafe language.

I don’t read this as petty, it’s well noted by now that memory safe languages are increasingly recommended to avoid classes of errors.
Highly recommend the core.py podcast if you're interested in the background, there are a few episodes that focus on the GILectomy:

-Episode 2: Removing the GIL[1]

-Episode 12: A Legit Episode[2]

[1]https://www.youtube.com/watch?v=jHOtyx3PSJQ&list=PLShJCpYUN3...

[2]https://www.youtube.com/watch?v=IGYxMsHw9iw&list=PLShJCpYUN3...
People have asked me to write something like this many times and one of the main reasons I haven't is because it's so open-ended.

With Crafting Interpreters, I felt like there was a reasonably small self-contained language I could come up with that covered almost all of the concepts I wanted to teach: variable scope, functions, closures, classes and dynamic dispatch, control flow, etc.

With type systems, there are a lot of forks in the design space and no clear "best" path:

* Does the language have subtyping or not?

* Are generics erased or reified?

* Is generic code specialized at compile time or not?

* Is type inference local or Hindley-Milner?

Any choice I make here would miss out on a lot of important material from the unchosen branch and disappoint readers who wanted me to take the other path.

Maybe the right answer is a broader survey-style book that tries to cover a bunch of different options (like Types and Programming Languages). But then you lose the fun of building one coherent thing.
I've been on both sides of bug bounties for many years. In truth, no one is offering a comparable bounty to what you can get selling exploits to a reseller. The closest would be Apple or Google with their million dollar bounties for cell phone exploits, but even that is likely underpaying.

The real value of bug bounties is for less sensitive products that aren't really big targets for nation states. Startups with products that haven't seen wide deployment in sensitive industries, for example.

There are many people who are perfectly happy getting "rep" and lower payouts for finding flaws in even the highly targeted applications, thankfully.
So if you find several catastrophic vulnerabilities each year, then you can make as much as one of the many people whose jobs it was not to create those vulnerabilities in the first place? :)
The kind of work the article means is where there is no measurable impact to the work done. These jobs are easily found in large bureaucracies where a wide range of activities exist just so that they are performed, but nobody would notice it if they weren't performed.
Everything isn’t for everyone, that’s true.

I want the world to have good products that are for lots of people.

Having lame things that are rent-seeking with no functional benefit is not good. Saying “it’s only for idiots, not for everyone” isn’t very constructive.

I’d rather people make products that are efficient and equally beneficial for creator and user. Not to exploit every drop of value from users that they can without making users quit.
Stalin, the Machiavellian Prince
If I remember correctly, Houston is one of the most Air Conditioned cites on earth. In the older days, Houston was much smaller with less concrete and paving that holds the heat in, making the entire area warmer. Plus, older houses were designed for the climate that they were in. Now, every place in the US basically gets the same house design regardless of the climate.
Obviously it is bad, but the article explicitly claims that following the specifically described process "an attacker can jump from any web page to full command execution" which is simply false. This is dishonest regardless of how "central" it is, or how much we could imagine a different exploit.
As if they prefer this work to not earning money at all. Unless you are really rich, you can’t stop working and be fine too. I surely can’t.
I should clarify that I've been an engineer on the Dart team for a long time, but I wasn't one of the original designers of the language. (If I had been, the language would be pretty different.)

I am on the language team now, but I'm just one of the team members and not a lead. The Dart team is really fantastic. Every day I'm grateful I get to work with such a good group of people.
> Threads are more useful if you have lots of shared state and mutexes.

That's what always kicks me in such things. If the processes are truly completely separable, awesome! It never seems like they are as much as I wish they were.
On bro plus that side doesn’t pay taxes / it’s free cash anyway
> in this case there is zero moral quandary

And zero legal quandary.
Networking is already supported through the Tailscale network. Once you login, the vm should be able to connect to the internet through your exit node.
If you read the article, the answer to your question is in the fourth sentence. There's even an entire section under the headline "Who, Why, and How" that goes into motives.
The features were never turned on by default, so they are not popular knowledge (I used DOS since 2.x and never knew).

https://forum.winworldpc.com/discussion/comment/171783/#Comm... (devices in \dev, "-" as switch char, etc.).

> While MSDOS had subdirectories, pipes were not supported at the kernel level. It was simply a convenience of COMMAND.COM that simulated pipes by running each command sequentially.

You are confusing the lack of concurrency with lack of pipes -- the mere fact that COMMAND can do what you describe requires UNIX-like pipes and channels (e.g. stdin/out/err), and programs avoiding direct console I/O (way common for DOS programs...). Comm software such as Kermit did the same thing to simulate remote login (I used this one in the day, at least).
curious why Saudi? Are they known to be prolific buyers of vulnerabilities?
This is from an email I got yesterday from PayPal:

"Google Referrer Header Privacy Settlement has sent you $0.11 USD."
> Can people explain why venv&pip is a bad solution that doesnt work for them they have to resort to other package managers?

It's very simple:

1. As you said yourself, you don't need venv at all.
2. The format used by `pip -r` (colloquially known as "requirements file") is not a defined standard.
3. pip is not a package manager, but a package version resolver and installer.
> There's no federal law requiring AT&T to hold onto this data.

This is false? https://www.law.cornell.edu/uscode/text/18/2703 https://www.usnews.com/news/articles/2015/05/22/how-long-cel...
How would one go about selling a good domain name and twitter handle for a failed project?
Why start at 1970 when Houston has a temperature record back to 1889? Start in the 60s and the jump is far lower. Or any other year and the difference changes.
Interesting, and sounds quite plausible. Perhaps they could have replaced the GUI with a X window lookalike instead of trying to brute force the old OS.
China rocked by cooking oil contamination scandal
https://www.csoonline.com/article/565048/what-hackers-do-the...

Financial motivations
Nation-state sponsored/cyberwarfare
Corporate espionage
Hackivists
Resource theft
Gamer issues

Financial theft and nation-state attacks are easily the largest portion of cybercrime. Decades ago, the lone, solitary youth hacker powered by junk food was an adequate representation of the average hacker. They were interested in showing themselves and others that they could hack something or create interesting malware. Rarely did they do real harm.

Today, most hackers belong to professional groups, which are motivated by taking something of value, and often causing significant harm. The malware they use is designed to be covert as possible and to take as much of something of value as is possible before discovery.