skysight-inc/HackerNews huggingface dataset:
Gemini says this:

"This is an article about a Reddit thread discussing why a diesel repair shop had a system-wide failure. The conversation centers around why industrial equipment, like lifts and cranes, would be running Windows and be connected to a network. People debate the pros and cons of having internet-connected machinery, with some arguing for the benefits of remote monitoring and updates and others expressing concerns about security vulnerabilities. Many users point out that some critical systems, like elevators, could be controlled with simpler and more reliable solutions."
Nope.

Headline misleading.

You can tell from background, because strong magnetic fields take an immense amount of power and space, and TMS & MRI magnets beyond 1 Tesla are the size and weight and density of an anvil. Nothing nano about magnets. Nanotech interacting electrically, sure, but nanotech interacting with living tissue magnetically is ludicrous.

Reading the actual article:

It isn't nanotech, it isn't controlling "the brain", it's testing a brain specifically genetically engineered to express magnetically sensitive control/sensory input sites that a TMS can target selectively.
Many do take credit cards. In The Netherlands and Belgium, the pay toilets in train stations allow tap to pay with a NFC card or your phone. Toilets in the airports are always free, though.
> how do you actually make this mistake while having the skills to build a web app of this complexity level?

By not building this yourself and instead outsourcing the work to India, to people that work for 4.00$/h

And I'm not blaming the person that has to work for this little cash for delivering shoddy work like this.
X doesn't either.

But OpenAI gets to keep their existing models, even if they can't enhance it using new data. That means fewer challengers to OpenAI.

Bad news for NVDA investors though.
Even if that were remotely likely it would make no sense.

Why would they ask to put half the country to a standstill because a foreign threat actor might have control of the system and might put half the country to a standstill?
If you really feel unsafe about incredibly low risk possibilities, your only choice is to stay indoors permanently. Most people feel safe walking because the chance of something happening is so unlikely.

Pedestrian deaths may have climbed in recent years because of increased smartphone use or changing behaviors. I see many more jaywalkers for example, especially by homeless drug addicts in west coast cities, many of whom just blindly step into traffic.

There is no rigorous way to attribute your claimed increase in pedestrian deaths to cars.
People go the speed they are comfortable with, not the speed on the signs. You have to design for the speed you want.
Whoops I accidentally exposed all API keys ever to the public.

No really this is unacceptable for a professional, it’s even bad for an amateur.

If your processes are so insecure that a little tired breaks your whole company you done goofed.
There are of course way more efficient methods for generating templated pdfs than using a typesetter.
This echoes my own experience. I made an attempt at andrew Ng's revised machine learning course last year. I could understand well enough at a high level how gradient descent worked but its been 20 years since I did any calculus and the level to which my ability to even do algebra had atrophied greatly. To their credit, they derive the equations for you but I did't see how I was going to be able to really apply any of what I learned when the caclulus "handwaiving" is probably the most crucial step.

I'm a fulltime CTO so finding textbooks that can fill in the gaps and finding endless problem sets to solve was just not going to work. Luckiy, A good friend of mind from hack reactor clued me in to mathacademy. I would argue thats its probably one of the biggest underated resources for getting back in mathematical shape. I've been setting aside an hour a day to just grind through the lessons and problem sets that it throws at me. it uses spaced repetition along with an inital placement test to figure out what you're weak at and just hits you with those problems as you improve.

echoing the sentiment in the article, you'll get better just grinding though different problem sets consistently each day with the occasional metaphorical boss battle. Once you realize that, actually getting better at math is more of a logistical challenge (having to track down skill appropriate problems to cut your teeth on) Mathacademy basically automates that completely for you. I've gone from giving up on ever getting into this machine learnign stuff to looking forward to spending next year taking on deep learning.

PS: not paid by mathacademy.com. just an incredibly pleased custoner

Also PS: didn't realize you worked at math academy. any plans on expanding into physics problems? would LOVE these ideas to delve back into phsyics. (especially circuits.)
It isn't just the old industries. This habit has infected the 21st century tech world as well.
Par for the course for Rand Paul.

He is nothing if not consistent.
Not quite true, you can utilize peer to peer (p2p) storage options, where only the individuals that are allowed to edit and view the document/media/file do storage. Really you only need one peer that has an IP address to do NAT traversals, that peer need not do any storage, but just passes transactions along to the end users.

With IPV6 and Torr onion routing NAT traversals is almost becoming a non issue.
This doesn't require an internet, just a LAN.
We needed only a couple of used old iPads from the marketplaces.
It's later that we learned majority of these companies have ''no valuable gifts'' policy where they must return things like these, so we just kept reusing the returned ones.
Think about things like browser profiles or password managers that are kind of predicated on multi device and how none of that stuff is what you’d call zero setup. Does every app that wants to do this stuff need a key base or drop box backend? Is apps joining an ad hoc k8s network mesh or relying on a preexisting central redis or postgres or something really necessary for something like sharing data structures?

There’s definitely some room for interesting work here and language level support could be cool.

Elixir interpreter clustering and otp is maybe the closest existing thing, which is awesome but only for existing erlang fans.
Well it could be this person that is professional and does not sell all your data to North Korean ransomware gangs - or it could be the one that does.

Which one do you prefer?
Solid State Batteries Are Here: Yoshino Power Station by UndecidedMF YT [video]
As humans, we like to copy things we consider good. I know I tried to use writing styles I thought were funny with varying results. I think I will say never ( or as close to never as possible ).
Giving blood is one of those easy and rewarding actions that you can do without expecting anything in return. Going voluntarily through a small inconvenience just to give something others need, and doing it without any market involved, money, points, karma, rewards, is a nice human experience to me. Maybe that's just my compensation, but the point is, try it, do it, enjoy the act of helping for free.
This is a perfect use case for LLMs at the moment. I wrote a script to update and express code base to hono. I got Claude to write a regex that would match the handler to the route and called the Claude 3.5 api with an example conversion and some other relevant context.

With the right prompt, it produced extremely clean and workable code.

~20 controller files and over 100 route handlers were converted in about 20 minutes and 5 dollars.

The engineering cost of migrating code bases is trending to 0
It's not even a realistic representation of the commute choice. In the US, with a heavily car centric culture and ~stupid housing policy, we still have an average daily commute of about 55 minutes. Aren't gonna save an hour on that.
Between my experience and arXiv papers I've read I'd say this:

Personally I am willing to label 1000-2000 documents to create a training set. It's reasonable to make about 2000 simple judgements in an 8-hour "day" so it is something you could do at work or in your spare time in a few days if you want.

You can compute an embedding and then use classical ML algorithms from scikit-learn such as the support vector machine. My recommender can train a new model in about 3 minutes and that includes building about 20 models and testing them against each other to produce a model which is well tested and probability calibrated. This process is completely industrial, can run unattended, and always makes a good model if it gets good inputs. Running it every day is no sweat.

You can also "fine-tune" a model, actually changing the parameters of the deep model. I've fine-tuned BERT family models for my recommender, it takes at least 30 minutes and the training process is not completely reliable. A reliable model builder would probably do that 20 or so times with different parameters (learning rate, how long to train the model, etc.) and pick out the best model. As it is the best models from it is about as good as my simpler models, and a bad one is worse. I can picture industrializing it but I'm not sure it's worth it. In a lot of papers people just seemed to copy a recipe from another paper and don't seem to do any model selection.

My problem is fuzzy: the answer to "Do I like this article?" could vary from day to day. If I had a more precise problem "fine tuning" might pull ahead. Some people do get a significant improvement which would make it worth it, particularly if you don't expect to retrain frequently.

I see papers where somebody does the embedding transformation but instead of pooling over the tokens (averaging the vectors) they input the vectors into an LSTM, GRU or something like that and train the recurrent model. This kind of model does great when word order matters as in sentiment analysis. I found that kind of model was easy to train in a repeatable way a decade ago so that's an option I'd consider.
And so you're just going to dismiss the modern reality of cybersecurity threats?

"What happened to the good old days when we could all leave our cars and homes unlocked.."

Yeah no.
https://www.bonappetit.com/story/what-is-kosher-salt

https://www.maangchi.com/blog/using-salt

https://www.maangchi.com/recipe/tongbaechu-kimchi
Damn, maybe just go back to sleep and try waking up on the otherside of the bed.

This is normal behavior for bug hunters and I don't think they're doing it because 'it's cool". They do this for a living.
"Last term"? You think he's going to step down after his second term.
Pre-dating xwax and Mixxx there was "TerminatorX", sounds like it might be what you're interested in.
It's mind boggling how an organization the size of CrowdStrike, built on endpoint agents running in kernel-mode had such an #epicfail. Was all of QA out this week or something? It's truly mind boggling so I'm really looking forward to the post-mortem, if we ever get one.
> How was such vuln not found and abused in this case?

Maybe it was..

There might have been more value in leaving this one open than just screwing with them.
On the one hand - you can read this as a PSA for the apathetic and/or clueless 99.9%.

On the other hand - it's d*mn hard to imagine that any of America's "A List" or "B List" adversaries didn't have a far-more-detailed road map, years ago.
I am using pandoc to transfer some of my notes to the web: https://ykonstant1.github.io/power-draft.html
A Windows version from 1992 is saving Southwest's butt
So an hn comment is just "Praise, repeat, question".

These are so fucking shallow.
There's no analog for the sign. You just put it in because without it your scenario still feels like theft (because it is) and you end up arguing against your own point.
I'm surprised he didn't try harder to contact someone in the company privately.

Surely any contact would have sufficed to at least try to get an introduction to their security team?

If you browse their website there are loads of email addresses for various offices and divisions.
The problem I'm seeing is that when I move or resize the map, it makes requests to *.tile.openstreetmap.org, but not to roadway.report/accidents_by_location_geojson. I checked with desktop Firefox and Chrome.
This is the most needlessly complex, mustache-twirling, moderately evil-villain type plot.

The simpler explanation is often the answer here. Either (or both) their internal QA and release process is flawed or specific employees did not follow the process correctly.

These fantastical explanations of some big government conspiracy only serve to make the believers feel better about the fact that nobody is actually in control and shit just happens randomly which is honestly a far more terrifying prospect.
I expect we will see detailed forensics published by various third parties in the coming days and weeks. As to what CS itself will publish, that remains to be seen.
It would also be pretty damaging if it includes their LPs.
SpaceX Will Turn a Workhorse Vehicle into a Hulking Destroyer of Space Stations
Family pigs' and dogs' reactions to human emotional vocalizations
A couple of hours is absolutely nothing compared to the massive worldwide effort that many people have to put in to fix the problem of a company’s shitty product and release practices.

This is inexcusable, point blank. “A couple of hours is a long time” is not a valid excuse when the alternative, as clearly evidenced, is millions of computers and critical systems simultaneously failing hard.

This might have been different if it was a small subset of computers, but this clearly could have been caught in minutes with any sort of sensible testing or canary rollout practices.
> a16z did not give me any bug bounty on this because of the fact i publicly reached out instead of trying to reach out privately.

I just don't understand this petty attitude. This almost guarantees next time somebody that finds vulnerability with a16z or any of its companies to seek black market rewards that will do far more damage.

This is just like when KakaoTalk refused to payout bug bounty because you had to be a Korean citizen which ended up causing more vulnerabilities to be discovered in the wild.

Companies and billionaires reading this, please don't be petty like Andreesen. Guy went from a leader to a borderline security fraud artist. You don't want to be earning more ire from the public in the current political climate. It's dangerous.
> kosher salt, which we in Europe don't have

We do (whatever Europe means in this context) but no offense if you can’t even find salt then how do you manage gochugaru or fish sauce for example?

I did the the Munchies kimchi several times and it was always perfect

https://youtu.be/hM-v5nTp0J0

https://www.vice.com/en/article/nzkpj7/homemade-kimchi
If I leave other people’s stuff that I promised to take care of on the street and it gets stolen, I would be to blame.
It's also using hydraulics which are a big power drain.
Hopefully Martin Casado or one of the other awesome open source folks from a16z will take a look at this and make the person whole!
Microsoft: Helping our customers through the CrowdStrike outage
Didn't the Mac have one in 1984?
As suggested in https://news.ycombinator.com/item?id=41016144, OpenStreetMap is the thing for you; I suggest use the data with Organic Maps: https://organicmaps.app/

You can search for „drinking“ to find mapped fountains/drinking water: https://wiki.openstreetmap.org/wiki/Tag:amenity%3Ddrinking_w...
Based on your description, AWS has another level of stop, the "force stop", which one can use in such cases. I don't have statistics on the time, so I don't know if that meets your criteria of "timely", but I believe it's quick enough (sub-minute, I think).
It might have.
But where I live in Berlin there is exactly one public toilet for the whole district.
And it’s a pissoir only so if you are female or need no.2 you are screwed.

Might be different in another neighbourhood here.
It would be more accurate to say the dojs lack of breaking up apple, google, facebook, amazon et al has harmed and continues to harm consumers. Pe hates breaking them up because it will end the gravy train of abusing dark patterns to grow a monthly recurring user base and selling it to the above at inflated prices to maintain their market power but it is necessary. We need pe doing the much harder job of funding compabies with better ideas that can stand on their own amd grow into the next company that needs to be broken up for having too much market power (a task that takes twice as long and is less of a sure bet vs the currrent model). Post ww2 we broke up too many companies too soon, in the 70s and 80s we swung way to far to laissez faire and now we need to swing hard back towards pre 70s thinking but not quite all the way back.
Not in mine. Drivers who know about the camera's location speed down right before the camera and speed up immediately after
More like if they kept their wallets in an open basket on the porch.

It's not an invitation to take it, it's just really stupid.
> The brazenness - and visibility - of the hypocrisy and callousness of our leaders has eroded public trust.

I think this is overly cynical. There are, I think still plenty of politicians who get into politics to make things better for people, I really do. But they are faced with complex, hard-to-fix issues where there is nuance and compromise needed, and people get really pissed off about the nuance and compromise
It's not reliable and LLMs cannot create anything novel.

Your hypothetical company is going to end up pulling a Crowdstrike with this method and then they definately won't need an engineering budget!
What's your source on them not encrypting emails at rest? They claim they do: https://www.fastmail.com/features/security/
Right, I have never been in a situation that a re-write was considered in another language that it was not due to some other reason.

Most of the time it is first, we need to change some major functionality, we have an architectural issue, or something along those lines that will require a major re-write in the first place. So the idea of, maybe we should use a different language comes up.

The idea of re-writing something in another language and it is identical functionality just for the sake of using another language just isn't a normal exercise unless you have a CTO pushing for something unnecessarily.

Maybe, maybe I could buy saying we don't want to manage Java servers anymore or something along those lines. But even then, why break something that works.

This seems like such a bad idea, is going to introduce so many bugs, require a ton of testing, for a minimal at best gain?

And then yeah, who is going to maintain it given that no one actually wrote the code in the first place. Goodby historical knowledge and productivity. Hope you don't find a critical bug as soon as you release it that needs to be fixed asap.

Don't do this, a seriously bad idea. That assumes that it is somehow a 1:1 functionality which by now we should be well aware that an LLM is going to make mistakes.
what would be funny is if crowdstrike demanded ransom from their castomars.

security is a great business - you play on people's fears, your product does not have to deliver the goods.

like the lock maker, you sell a lock, the thief breaks it, but it is not your problem, and you sell a bigger badder lock the next year which promptly gets broken.

as a business, you dont have any consequences for how your product works or doesnt work, what a great business to be in !!
This is a simple problem to understand and solve. Corporations need to buy a license from CrowdStrikeCrowdStrike.com. This allows large corporations that do not know crowdstrike is a security nightmare built on top of the microsoft security nightmare to assure themselves they are now secure.
I made a vscode extension which I charge money for. I mainly relied on reddit + seo to gain users. Eg: I made interesting reddit posts, and made a pretty website. Then users find it organically
I’m self hosting using TabbyML and running StarCoder 3B on my nvidia rtx2080 super and I can’t imagine coding without it anymore. It consistently, across all languages I work in , gives me great completions.

People not having good success in this thread, I would suggest trying again
I (we) would obviously prefer the professional person who is doing good for society. The problem is, this behaviour isn't good for them. I am not an expert or anything but from what I know, pentesting without explicit prior permissions can easily lead to huge lawsuits. I would rather that the careless people get their cars stolen than the good people all lose heart completely.
my guess is internal tool that wasn't expected to be exposed publicly.

additionally, i didn't realize there are tools to automatically discover unreferenced subdomains like this. i would have just assumed security by obscurity
Using those credentials is still a violation of the he CFAA, no reasonable person would think they were invited to access the systems protected by those credentials.
I wouldnt mind a bot writing a comment on HN if it's thoughtful, which is HNs trademark. These comments are so damn void of any thought. You can flag them for being thoughtless alone.
Collecting the keys from a public source-code of a web page is legal (and can be safely reported).

Using these keys to access unauthorized systems is a crime.

This is a major difference.
To be pedantic, I pay federal taxes which are then loaned to the USPS with no expectation of being paid back, as well as P.O. box fees because the nearest no-fee pickup is at the county seat, as well as subsidizing the USPS exemption through local property taxes that have to absorb that overhead.

None of which are delivery related.
blame isn't mutually exclusive. you can still blame the person that stole it too!
Exactly, if he even just browsed their website a bit he'd have stumbled across loads of email addresses that could have been a useful point of contact.
I wish Crowdstrike's employees wouldn't take kindly to Crowdstrike bringing down hospitals and killing innocents.
import random
platform = random.SystemRandom().choice(["Astro", "Blogger", "Hugo", "WordPress", "Ghost"])
print(platform)
Whats the compelling reason to buy any of these vs picking up another arista 7050tx for sub 300 bucks on ebay? Atleast for a home user that can put the noisy switch somewhere the noise isnt a big deal,i dont see a lot compelling here vs the 2017 vintage gear that was 20k new and is now being offloaded with lots of life left
Positive ROI spending promotes growth.

For example paying for unemployment benefits and end-of-life healthcare just gets consumed. Similarly increasing military spending and having people just live on bases likely has a very negative ROI (as it removes people from the labor market).

The argument is that the government is in a unique position to fund infrastructure projects and do long-term investment in underfunded sectors. (Very high expected ROI, because - by definition - these are areas where some money goes a long way, that's what underfunded means, right? But simply maintaining a very large welfare state while economic productivity is bad is ... you won't believe it, but it's bad and unsustainable.)