skysight-inc/HackerNews huggingface dataset:
My friend wrote in Cobol until the day he retired. Every couple years management would spin up a project to replace the Cobol part. He and his team would consult. In the end he would just use the project to set his watch.
I'm curious, what use cases do you have for complex numbers that couldn't be provided in a 3rd party library or maybe even the stdlib?
98% of women in Somalia are sexually mutilated. Guess what Somalis are doing in France to their little girls? That s right: they re mutilating them.

But I take it 98% of Somalis women getting sexually mutilated in Somalia is the fault of colonization or something?
> The only way to avoid that is to never publish to the web, everything published to the web feeds AI. That is the web's purpose now.

And in doing that you also prevent real humans from accessing that same content. Look, I have no simpathy for AI companies. I wrote about it before on my site, will probably write again. The current situation sucks. But giving up is not the right answer imo.

> Also there are plenty of people who create content because they love it, and also need to be able to make a living at it, because doing so at the level of quality they want is time consuming and expensive.

Fair but those are the minority. I'd argue the vast majority of people create content because they enjoy the process and earn a living in other ways. I run a newsletter where I interview people with blogs and so far, after a year running it, not a single person has told me they blog for a living. Every single one is doing it for passion. And I suspect that's true for the vast majority of people out there. The bulk of internet content (when it comes to creative content that is) is created by people who do it as a hobby.

> But mostly because even people who produce content because they love it want to share that content with the world and that will be nigh impossible when the only content anyone sees, and that any platform or algorithm surfaces, is AI generated. Why put in the effort and heart and work to create something only for an AI to immediately clone it for ad revenue? Why even bother?

Why even bother? Because there are people out there who care. And the assumption that "the only content anyone sees, and that any platform or algorithm surfaces, is AI generated" is a wrong one imo. I can assure you that there are PLENTY of people out there who still value original content, still value connecting with real human beings doing things because they love the craft. Assuming everything is doomed is not helpful.

Is it going to be harder? Yes. Are there solution? Yes.
Those come from latin lex, rex, so possibly more related to sloppy handwriting getting standardized?

Edit: on the other hand, x used to be read /j/ (e.g. Quixote, Mexico), so also possibly lex —> lej —> ley
see, that's Castro mistake. he didn't buy scalps from land owner exploiters. imagine if all natives were in Florida today instead of dead.

Russians were more aligned with usa tho...
Not really a surprise, to be honest. "Deserialisation" encapsulates most forms of injection attacks.

OWASP top-10 was dominated by those for a very long time. They have only recently been overtaken by authorization failures.
Nowhere did I do that.

Also, it wasn't solely the 6 teens, it was also their parents and their communities at large outraged about what the teacher did and wanting his head on a spike (show a drawing of Muhammad). Not to forget the spark of the outrage, the girl who was skipping class and lied about what the teacher did, which instigated it all.

There was also that small Charlie Hebdo thing, and the Quran burning in Sweden, and countless other similar events over the years in Europe alone.

I was born and grew up in Indonesia, and the crap that was happening in Aceh, one of the only islands in Indonesia that practices Sharia law whereas the rest of the country is more secular, churns the stomach. I have no problems with Islam for the most part, but proponents of Sharia law are truly sociopathic monsters that have no place in the 21st century.
Zero effort to fuzz test the parser too. I mean, we know how to harden parsers against bugs and attacks, and any semi-competent fuzzer would have caught such a trivial bug.
Yes, and now even that tiny pool of funding is going to be cut.
The anecdote about setting the lawyers on the kid who extracted the art assets from Pokémon.exe feels like a real ethical low point.

If you’re a lawyer going after children who take the screws out of the backs of alarm clocks then I’m afraid you’re the bad guy. People like that ought to be held accountable by their regional bar association.
>It sounds like justification for a “slave” class to do undesirable jobs

It's the exact opposite. The slavery is being trapped in Cuba which the person decided to leave by their own free will to make it to America, where working a terrible factory job is going to make them ten times richer than they would have been otherwise.

Is you being uncomfortable with this idea actually more important than giving that person a shot to work himself to a normal American life within two decades and certainly for their kids?
yeah I thought about it but then it defeated the purpose of comments i.e. engagement and perspective of reader. Substack does a good job at it
thanks for letting us know you never read a book and take lessons from the tv.
This is a standard Usenet comment from Stallman, so I don't take it that seriously.

Tcl achieved many things, including the Tkinter GUI with a native look in Windows. Other projects like Python rely on it in the shrinking set of included batteries.

I would prefer if Lisp had won, especially in scientific code, but the C-API is not good enough. Unfortunately, currently Python is popular, so one thing is clear: People want a low level C-API in C with a published low-level interface. All other attempts have mostly failed in terms of popularity, so languages that want to take on Python better take note.
>especially for people with a more right leaning perspective on the world.

Why add this without any source lol?

Things like the leftie Palestine protests and the news streamer Hasanabi extensively get news from and use Twitter.
> By-passing the discussion whether one actually needs root kit powered endpoint surveillance software such as CS perhaps an open-source solution would be a killer to move this whole sector to more ethical standards.

As a red teamer developing malware for my team to evade EDR solutions we come across, I can tell you that EDR systems are essential. The phrase "root kit powered endpoint surveillance" is a mischaracterization, often fueled by misconceptions from the gaming community. These tools provide essential protection against sophisticated threats, and they catch them. Without them, my job would be 90% easier when doing a test where Windows boxes are included.

> So the main tool would be open source and it would be transparent what it does exactly and that it is free of backdoors or really bad bugs.

Open-source EDR solutions, like OpenEDR [1], exist but are outdated and offer poor telemetry. Assembling various GitHub POCs that exist for production EDR is impractical and insecure.

The EDR sensor itself becomes the targeted thing. As a threat actor, the EDR is the only thing in your way most of the time. Open sourcing them increases the risk of attackers contributing malicious code to slow down development or introduce vulnerabilities. It becomes a nightmare for development, as you can't be sure who is on the other side of the pull request. TAs will do everything to slow down the development of a security sensor. It is a very adversarial atmosphere.

> On the other hand it could still be a business model to supply malware signatures as a security team feeding this system.

It is actually the other way around. Open-source malware heuristic rules do exist, such as Elastic Security's detection rules [2]. Elastic also provides EDR solutions that include kernel drivers and is, in my experience, the harder one to bypass. Again, please make an EDR without drivers for Windows, it makes my job easier.

> *It could be audited by the public."

The EDR sensors already do get "audited" by security researchers and the threat actors themselves. Reverse engineering and debugging the EDR sensors to spot weaknesses that can be "abused." If I spot things like the EDR just plainly accepting kernel mode shellcode and executing it, I will, of course, publicly disclose that. EDR sensors are under a lot of scrutiny.

[1] https://github.com/ComodoSecurity/openedr
[2] https://github.com/elastic/detection-rules
the point is it took less than a decade and half...
That's okay, it doesn't work* without a login anyway, tracking protection on or off.

* as in you can't see the whole thread when people give you a twitter link if you don't have an account.
Twitter also doesn't show me everything, and content is algorithmically curated. And nothing is vetted. So why's that any better? Also, everything? Everything what? "The media" doesn't show me everything for obvious reasons. You can't digest everything. Because this is how "everything" looks like: https://firesky.tv
The world would be a quite different place if the majority of people in each country made rational choices for their own good. I don't think we should single out Cubans for that
Alpine Linux. I'm sure they do run that one.
This is a pretty good high level overview:

https://ziglang.org/learn/overview/
I was thinking exactly that: BetterSnapTool has great reviews and many great reviews at that. I can't see why you'd pay money to have... more of those?
Yep, this is a big part of it. Intelligence and consciousness are barely understood beyond "I'll know it when I see it", which doesn't work for things you can't see - and in the case of consciousness, most definitions are explicitly based on concepts that are not only invisible but ineffable. And then we have no solid idea whether these things we can't really define, detect, or explain are intrinsically linked to each other or have a causal relationship in either direction. Almost any definition you pick is going to lead to some unsatisfying conclusions vis a vis non-human animals or "obviously not intelligent" forms of machine learning.

It's a real mess.
What's even worse that this asshole was legally correct, of course he was, one of the bad laws is the passage of DMCA which bans circumventing digital protections. That's how you get bullshit like DVD Jon who was accused of trespassing on his own computer.
Firefox Focus is not an adblocking browser. It blocks tracking.
Show HN: I made helpers for Web Components
The US government agrees with you than unnecessary use of very unsafe languages is a serious cybersecurity problem. [0][1]

A slight aside: Rust is typically held up as the obvious safer alternative to C/C++, as if Ada never existed.

[0] https://stackoverflow.blog/2024/03/04/in-rust-we-trust-white...

[1] https://news.ycombinator.com/item?id=33560227
There used to be Winpooch Watchguard, based on ClamAV. Stopped using it when it caused Bluescreens. A "Killer" indeed.
Not real Firefox. This post means Firefox on a desktop OS that is not crippled and Android.
And the Dutch digraph/ligature "ij" is like "y" with an umlaut.

https://en.wikipedia.org/wiki/IJ_(digraph)
Blanket accusations like this are racist. Genital mutilation is an abhorrent practice. While the impact is uniquely horrible for women, it is definitely "throwing stones in glass houses" to act as though it's a strange cultural practice to damage the nerves of a child's genitals, a practice done to millions of boys in Europe by those of multi-generational European descent.

Now, you could be opposed to both practices of course, but you are choosing to make a blanket accusation to suit a point of view.
I can't see how an insurance company is going to spot carelessness that produces fatal bugs any better than its developer.
"Java's Checked Exceptions are the right idea and just need better syntactic sugar."

You strictly type your regular return values so that people have to make a clear decision about handling them, and everyone's fine... But do it for predictable categories of error, and some people lose their minds.
The real thing I've learned from this is that most malware doesn't get ring 0 access, but these "antiviruses" solutions can shutdown the whole critical infrastructure everywhere. I've never seen malware that infected millions of devices in seconds and made them unusable for days and maybe weeks to come.
Do you have more Infos on the story?
Clearly the problem is that software with the system access, many security packages need, makes it nearly indistinguishable from malware and is an obvious risk factor in the supply chain. Of course having the cause and supposed solution for the safety and operational capabilities be the same piece of software leaves open quite a few questions.
I cant make a new account as my old one got banned and they also banned my phone number so I cannot make a new one anyway.
> It’s not your machine, it’s your employer’s machine.

Agreed. I'm fine with this, as long as the employer also accepts that I will never use a personal device for work, that I will never use a minute of personal time for work, and that my productivity is significantly affected by working on devices and systems provided and configured by the employer. This knife cuts both ways.
GP was complaining that new modern Tex competitors should be designing for this, to correct the fact that Tex doesn’t.
I would like to point out that the Tcl C API is exceptionally well-written and provides a robust low-level interface that many developers appreciate. For those interested, you can find the documentation here: https://www.tcl.tk/man/tcl9.0/TclLib/index.html
Checks are quite foolproof too - spelling out the number (a hundred eighty eight) and writing the number (188), like on checks.

The paragraph you mention seems to worry more about mistakes more than tempering attempts though (taking 10x the dose prescribed could indeed be problematic)
I mean, it’s drawing a _bit_ of a long bow, but there’s a pretty cogent argument to be made that European powers in many nations funded/armed criminal gangs (by buying slaves/selling weapons), and those gangs took over the country with that backing, which destroyed what public institutions existed, and normalised “strongman coercion”.

There’s various points and counterpoints within that and I’m woefully ill equipped to evaluate them, but it’s not wrong “prima fasciae”.
Microprocessors are still relatively recent.

What about a bunch of other things like smelting iron or teaching everyone to read? They don't seem like choke points because we are long past them.
Based on overwhelmingly negative response by IRC we have decided to switch to python to ensure features are shipped when they are good enough to ship. Also we have decided to switch to Microsoft / Hubspot for operations away from org mode and foss. I am frustrated I tried to create these operations at a bit of reputational cost for the sake of my old homies on IRC but they both do not remember me and also apparently hate/are disgusted by me. I am glad to learn these very unpleasant lessons NOW rather than 3 months from now when the stakes are much higher.
> Those come from latin lex, rex

No, in fact they descend from the accusative forms, lēgem and rēgem. I don’t know much about the precise evolution, but g → y strikes me as a perfectly normal sound change, especially before /e/. Looks like it happened in the other Romance languages too: compare French roi, Portuguese rei, Italian re, etc.
Not on X anymore, but I just tried with Firefox strict tracking protection enabled on Mac and it opens (not logged in or anything).
It's just a play on any sufficiently advanced technology is indistinguishable from magic. I don't think you need to think about it too much.
Right? I was raised that way. My girlfriend clearly wasn't. I always close the door in between grabbing/fetching more stuff to put inside. It takes a couple of seconds I guess, but keeping it open for a long time is just really wasteful.
> i can't believe i'm writing a reply to a guy whose name is broken spanish for 'brando, the little fuck'. (literally. there isn't an alternative interpretation.)

Oh cool, I had no idea.

Now to your point: have you ever worked in cybersecurity in large, complex and heterogenous companies? and have an idea about what is required to keep such a company secure within the reality of its business?

If yes - congratulations, you should be nominated as CISO of the century. I would seriously like to learn from you.

If not - well, I can give you a lot of advice about football (which I do not follow but I am a great consultant) or DIY (which I am bad at but I am ready to build an electrical and plumbing installation because I saw that in Youtube and, frankly, it looks easy).

We can troll our way indefinitely - but I have a lot of work related to this CS disaster. I am super glad for CS, though, for the time and stress it saved me in the past.
Hey but that highly efficient thing in your links has no legs...not cool *irony off

Sometimes I really think these inventors are just being stupid for the sake of being cool.
It's been like this for a while. You can prefix archive.today/ in front of xitter links if you really want to open them.
It's has to be the understatement of the century to call what CrowdStrike did "shipping a bug."
My family lived in Yugoslavia near the Italian border within a zone where people were issued special passports allowing them to go across the border to the west. This was not generally possible, so people took advantage of it and bought (or smuggled to avoid trouble with the customs) many goods which were not available inside the country, like jeans, washing machines, vinyl records, ... My uncle brought both the ZX spectrum and the Commodore back with him on one of such trips. And then during that time our student radio station used to play whole computer programs and games live on air, and everybody could record them to a cassette and load them on their computer, for free!
I find it hard to believe they didn't do any testing. I wonder if they tested the virus signatures against the engine, but didn't check the final release artefact (the .sys file) and the bug was somehow introduced in the packaging step.

This would have been poor, but to have released it with no testing would have been the most staggering negligence.
A residential rotary gas meter costs less than €15, and that's the long tail you need to replace to measure losses accurately.

Edit: And current turbine and aperture flow meters cost hundreds.
100% that even if that situation were to arrive, it would never go down that way anyway. It's a complete fantasy they have in their head about how they're not the corporate stooge they actually are along with everything else this guy views about himself.
In my experience they cost a lot more than $300 an hour.
As the old saying goes, everyone has a test environment, and some also have a separate production one.
Does the switchboard in a nuclear missile launch facility run Crowdstrike? I picture it as a high quality analog circuit board that does 1 thing and 1 thing only. No way to run anything else.

Globally networked personal computers were kind of cultural revolution against the setting you describe. Everyone had their own private compute and compute time and everyone could share their own opinion. Computers became our personal extensions. This is what IBM, Atari, Commodore, Be, Microsoft and Apple (and later desktop Linux) sold. Now given this ideology, can a company own my limbs? If not, they can't own my computers.
Are their DMs open though? Can’t DM someone who isn’t following you.
Great observation. I’m European and I agree.

We Europeans love to look down upon America when it comes to stuff like functional government, bicycle paths and public services, but wrt immigration we’re so far behind the US, it’s not even funny.

> a path toward integration (as in, "to become American"; there is neither an equivalent aspiration nor option "to become French")

We really need to copy this vibe wholesale from the US (and Canada). That people can move here but even their grandchildren won’t feel that they’re properly French (or in my case, Dutch) is obscene.

I like your observation that the root cause is the ethnic character of our states but that doesn’t mean we can’t take a note or two out of the American playbook. Truth is we’re not even trying.

Instead we’re hopelessly split between the left who stubbornly refuse to acknowledge that there’s a problem (and calls you a racist when you try), and the right who want to hold onto some ethnic nation state pipedream that we never were and never will be.
There is a story out that the problem was introduced in a post processing step after testing. That makes more sense than that there was no testing. If true it means they thought they’d tested the update, but actually hadn’t.
The triggering file was all zeros.

It is not possible that only this pattern caused the crash, and fuzzing omitted to try this unfuzzy pattern?
How do they test this stuff? Acceptance/integration testing?
The sensor basically monitors everything that's happening on the system and then uses heuristics and known attack vectors and behavior to for example then lock compromised systems down. For example a fileless malware that connects to a c&c and then begins to upload all local documents and stored passwords, then slowly enumerates every service the employee has access to for vulnerabilities.

If you manage a fleet of tens of thousands of systems and you need to protect against well funded organized crime? Employees running malicious code under their user is a given and can't be prevented. Buying crowdstrike sensor doesn't seem like such a bad idea to me. What would you do instead?
I have to agree with RMS that 1994 Tcl was pretty terrible. I remember cursing the lack of structs while using it for a larger program. All of this has been largely fixed in more recent versions.

On the other hand, 1994 Tcl/Tk was the best way to create simple user interfaces, and is (IMHO) much better than current tooling.
This is also neat, like simpler minimal version of Fume or GPT-Engineer. It seems really useful. Good job!

Prelude is rather meant for when you are pair-programming with a chat model and find yourself pasting a lot of context to remind the model of the state of your code. I always have terminals open anyway, so having it as a CLI tool rather than needing to make requests to a server, makes sense for me.
I'm curious as to which ones they do not have compared to Adobe products.

The only one I can think of is proper material layer painting in Blender, you can get there with addons but haven't found one that's as good. Genuinely the only thing that I miss, and I do this full time.
More or less. Binary parsers are the easiest place to find exploits because of how hard it is to do correctly. Bounds checks, overflow checks, pointer checks, etc. Especially when the data format is complicated.
Now i wonder if there's a connection between j and ; as termination character.
Of course twimg.com is _probably_ owned and operated by Twitter.

https://www.whois.com/whois/twimg.com

Looking at the registrant email confirms that it is. I've seen the twimg domain a lot as it's used for their images (pbs.twimg.com) too.
I suppose local market specifics come into play, and for a reason unbeknownst to me, most domestic debit cards where I live are MasterCard branded.
AV software is a great target for malware, badly written, probably runs too much stuff in the kernel, tries to parse everything
The search function in the App Store is also quite bad – it finds only a small fraction of relevant apps, and then throws irrelevant sponsors on top.

Reddit and Google are both better for discovering what to look at in the App Store.
The article is about stopping the fridge beeping when you leave the door open.

Your comment is about removing a fridge from the wall.