skysight-inc/HackerNews huggingface dataset:
There is a reason that anyone who cares about forks being private forever, (even if you delete it) should never use or trust a third party. I never use Github. I run my own git server and everyone else should to in my opinion. Github has always been a huge security problem.

But that's just me...
Why is Xi Jinping building commodity stockpiles?
Served as word vomit.
>> "Oh no, efficiency will be down and the execs' stock options might not be worth quite as much."

> Translation: employees have to work with someone who is not pulling their weight (always unpleasant) and their own stock based compensation might not be worth quite as much (hurting the income of individual programmers) and the manager has to deal with the hassle of a termination process. So forgive me for having exactly zero sympathy with candidates trying to use AI slop to game the system.

Congratulations, you just got fooled by a cognitive trap! Your prize is getting to be mislead and getting to help mislead others!

Large organizations and other powerful interests are very good at playing games to direct blame away from themselves and direct harm towards sympathetic parties. It's one of the techniques they use to maintain their power and create space to do harmful things that advantage themselves.

In this case, you're getting fooled by having one layer of indirection. In this case, (A) the company sets the policies that cause the harm you're sympathetic to (e.g. putting employees under pressure they feel every bit of dead weight, neglecting things like reasonable training and on-boarding periods so people are "dead weight" if they aren't a perfect fit on day one) in addition to (B) the other policies they set (e.g. an unreasonable demand for a perfect fit) that make job searches a demoralizing slog. That way, you're mislead into blaming the people the company harms with (B) for the hard the company does with (A).
tbh. given the high intelligence of Octopus and they capabilities to seemingly have quite "sentient" emotions do we really need to eat them as delicacy

(But also this argument is a losing one for most not vegetarians, because in difference to what is often believed both cows and pigs are also relative intelligent. Like if I remember correctly cows are roughly as intelligent as a 7 year old kid.)
Show HN: LLM Shader Art
LLM-powered natural language interface to GLSL (shaders). Sample instructions to try out: (1) make a smooth colorful white ring (2) have the ring expand outward into an infinite animation and pulsate
Another thing is the ability to actually have a breakpoint in the program. There is a lot of distributed systems (especially embedded ones) where just stoping the program and inspecting the state will cause the rest of the system to enter some kind of failure state.
> sometimes I really struggle to articulate what they're [LLMs] good at

I think of them like a person with entry level experience and an IQ of about 80.

That doesn't seem super useful, only... that "entry level experience" isn't in a single field. It's in literally everything.

It takes some time to figure out how to interact with them in a way that reliably gives the results you expect, but once you do, you can get a lot done. Taken to an extreme, a mid-career professional can essentially become a team lead that manages LLM-driven processes instead of a team of employees.
So that would be choosing consistency over availability.
Read the next sentence: "We only care about machines insofar as it serves us."

Imagine a machine doing "work" that only serves itself and other machines that does no service to humanity. It would have no economic value. In fact the whole concept of "work" only makes sense if it is assigned economic value by humans.
Nope. I do not take stimulants. Your rewrite is good btw.
This is a stunning endorsement of OP's point.
I keep my decaf beans frozen. That seems to help a lot.
End of an Era: Sony Cuts Production of Writable Optical Media
If AI stays in the computer form though..
> Allow physical access to change crypto keys etc, but instead focus on making it easy to audit and detect when it has happened.

Shooting the breeze as well...

Have some (non-modifiable, non-updatable) portion of the firmware that, on boot, calculates a checksum or hash of the important bits at the beginning of the chain of trust (efi vars, bios).

Then have it generate some sort of visualization of the hash (thinking something like gravatar/robohash) and draw it in the corner of the screen. Would need some way to prevent anything else from drawing that section of the screen until you're past that stage of boot.

That way every time you boot your computer you're gonna see, say, a smiling blue kitten with a red bow on its head. Until someone changes your platform key / key exchanges or installs a modified bios, and now suddenly you turn the computer on and it's a pink kitten with gray polka dots.

That way you don't have to actively _try_ and check the validity. It'd be very obvious and noticeable when something was different.
It would be nice to have more of a peer-to-peer infrastructure (torrent inspired) for serving big resources.
What a miserable company.
> Secure Boot ensures that a device boots using only software trusted by the Original Equipment Manufacturer (OEM)

"We sold you this house with a front door designed where our key will always let us in". Why do we put up with this shit?
It solves it in the sense that it empowers the devs to update their dependencies on their own time and ops can update the underlying infrastructure fearlessly. It turned a coordination problem into a non-problem.
Yeah, I mean "interesting" problems (perhaps not fields medal interesting, but interesting enough)
Rejewski, Zygalski, Rozycki https://en.wikipedia.org/wiki/Marian_Rejewski
It shouldn’t count. We need to require it be able to ELI5 the proof to Goldbach’s conjecture to an actual class of graduating kindergartners.
The name's a presumably ironical spin on the title of an old kid's book, "Five Little Peppers and How They Grew", by Margaret Sidney
I added that to the text above. Sentence taken from https://haystackeditor.com/#faq. Hope this helps.
When these tools come up, I like to post my little list of similar tools, for those interested. Apparently it's a hobby of mine:

* fq - like jq for binary data: https://github.com/wader/fq

* Kaitai Struct - https://kaitai.io/

* visualizer, for the above: https://github.com/kaitai-io/kaitai_struct_visualizer/

* HexFiend - a hex editor, but with "binary templates" feature : https://github.com/HexFiend/HexFiend

* binary templates, for the above: https://github.com/HexFiend/HexFiend/blob/master/templates/T...

* binspector - https://github.com/binspector/binspector

* binary-parsing - a collection of links to similar such tools : https://github.com/dloss/binary-parsing

* unblob - https://github.com/onekey-sec/unblob

* ImHex - https://github.com/WerWolv/ImHex

* GNU Poke - https://www.gnu.org/software/poke/

* dtrx - https://github.com/dtrx-py/dtrx/ dtrx

* feng - https://github.com/martinlindhe/feng

** they also have a similar list of prior art: https://github.com/martinlindhe/feng/blob/main/RESOURCES.md

And some previous HN threads for similar such tools:

* https://news.ycombinator.com/item?id=34434249 (unblob)

* https://news.ycombinator.com/item?id=34986042 (GNU Poke #1)

* https://news.ycombinator.com/item?id=36182873 (GNU Poke #2)
I love this web oriented develop once and run everywhere magic, that is exactly like that, it's a kind of magic that is not the reality, works in some theaters only.
There’s no workable Excel alternative, FOSS, OSS or paid. You can deal with the word processor and presentation software, but Excel is alone in a class for itself.

Also not sure how you deal with LDAP/Kerberos - is samba good enough for large deployments?
I can't speak from a Japanese perspective, but there's definitely a specific-to-general or general-to-specific nature to languages.

"If you can get it in the next 60 seconds there's a million dollars in the jar in the back right of the second shelf of refrigerator." My wife is Chinese, she works from a general-to-specific worldview and I would be surprised if she could follow those directions in the time limit.

Flip it and say "If you can get to it in the next 60 seconds there's a million dollars in the refrigerator, on the second shelf, in the back right, in a jar." and she would have no problem with it.

We focus on the specific, build up the image of it's environment and then paste it into the world. She refines the world so all the references are left hanging until the whole sentence is complete and that's probably enough to confuse her. We just find her approach to feel odd but we can still follow it much better than she can follow ours.
This brought back memories when I was reading reversing tutorials from searchlores.org and fravia.com...

It's in web archive now, https://web.archive.org/web/20191201105759/http://search.lor...
Why don't you think that AI models will, perhaps rather soon, surpass human capabilities in finding security vulnerabilities? Because an AI that's even equally competent would be a fairly catastrophic event.
The one shipped with Debian
Python's pytest framework achieves this without macros. As I understand it, it disassembles the test function bytecode and inspects the AST nodes that have assertions in them.
I've thought about that and have written some fun Haskell code in the past but... the other goal is to actually have users :D. I've also considered Lisp, Scheme, and friends to have really easily parseable ASTs.

I jest a bit, but there's a very rich ecosystem of really useful data analysis libraries with Python that do somewhat exist in other ecosystems (R, Julia, etc) but aren't nearly as... I would use the word polish, but a lot of the Python libraries have sharp edges as well. Well trodden might be a better word. My experience with doing heavy data analysis with Python and Julia is that both of them are often going to require some Googling to understand a weird pattern to accomplish something effectively but there's a much higher probability that you're going to find the answer quickly with Python.

I also don't really want to reinvent the universe on the first go.

It has occurred to me that it might be possible to do this in a style similar to org-mode though where it actually doesn't care what the underlying language is and you could just weave a bunch of languages together. Rust code interfacing with some hardware, C++ doing the Kalman filter, Python (via geopandas) doing geospatial computation, and R (via ggplot2) rendering the output. There's a data marshalling issue there of course, which I've also not spent too many cycles thinking about yet :)

Edit: I did copy and paste your comment into my notebook for chewing on while I'm travelling this weekend. Thanks for riffing with me!
This is awesome. Are you using tldraw?

We're building a canvas for data / analytics at Definite[0]. Quick demo[1].

0 - https://www.definite.app/

1 - https://youtu.be/7FAJLc3k2Fo?si=kxu0QLd4WV_jDCHw&t=79
Generally for sites:

1. gets incrementally slower until firewall user rate limiting tokens refill the bucket (chokes >6MiB/min bandwidth use, and enforces abnormal traffic ban rules.)

2. Pauses serving a page if you spider though 6+ pages a minute (chokes speculative downloading)

3. if you violate site usage rules 4+ times in the past hour, than your get a 2 day IP ban

4. if you trip a spider trap, than you get a 5 day ban

5. If you are issued more than 5 context cookies, than the IP will get spammed with a captcha on every page for 5 days

6. If you violate any number of additional signatures (shodan etc.) than you get your IP block and route permanently banned. There is only 1 exception to this rule, and we don't share that with anyone.

7. The site content navigation is programmatically generated in JavaScript

8. The legal notice is very real for some people

Have a nice day friend, =)
I think that this is part of the way to do it, but not all of it. I might consider:

0. All of the BIOS code and other hardware code should be FOSS. This should be printed in the manual as well. A simple assembly language might be preferable, and if the hex codes are also printed next to it, they can also be entered manually if necessary.

1. The operating system cannot update the BIOS at all. To do so requires to set a physical switch inside of the computer which disables the write protection of the BIOS memory, and also disallows the operating system from automatically starting.

2. Require keyboards, etc to be connected to dedicated ports, not to arbitrary USB ports. (This is possible with USB but is a bit difficult; PS/2 would be better.)

3. You can program it manually (whether or not the BIOS memory is write protected) without starting the operating system (this makes the computer useful even if no operating system is installed); perhaps with an implementation of Forth. When BIOS memory is write enabled, then such a program may be used to copy data from the hard drive to the BIOS memory.

4. Like you mention, it should make it easy to audit and detect when keys have been changed. An included display might normally display other stuff (e.g. boot state, temperature measurement, etc), but a switch can be used to display a cryptographic hash. If you always fill all of the memory (even if part of it would not otherwise be used) then it can be difficult to tamper with in the case of an unknown vulnerability.

5. I had seen suggestion to add glitter and take a picture of it, to detect physical tampering. This can help in order to avoid alterations of the verifications themself. If it is desirable, you can have multiple compartments which can be sealed separately, each one with the glitter. If some of these compartments are internal, a transparent case around some of them might help in some ways (as well as to detect other problems with the computer that are not related to security).

However, even the above stuff will need to be done correctly to avoid some problems, since you will have to consider what is being tampered with. (You might also consider the use of power analysis to detect the addition of extra hardware, and the external power can then be isolated (and a surge protector added) to mitigate others attacking your system with power analysis and to sometimes mitigate problems with the power causing the computer to malfunction.)
Modern gVisor uses KVM, not ptrace, for this reason.
https://www.aliexpress.us/item/3256803970893483.html

I've ordered trays (and they send the OEM tray) - unique barcodes, legit.

> Just give me a plain FPGA and MCU with no wizards or GUIs or automatic code generation.

You can pretty much cut out all of their tools and get a pure Yocto/Vivado TCL build for the bitstream for the 7 series Zynqs. Very low touch.

Their IO planner (in the Vivado IP integrator) is somewhat necessary for complex peripheral scenarios and is one of the few things I ever use Xilinx GUI applications for anymore.
Was Penrose Right? New Evidence for Quantum Effects in the Brain [video]
Really curious to see what turns up. A lot of stuff like geo-data and tools [1], as well as meteorological tools and models [2] were already partly public. Having worked for the federal administration and using their IT at least a few weeks yearly, the rest is mostly Microsoft and SAP software, or classified software that they can’t and won’t release.

In Switzerland, a lot of public services are located at the « Cantonal » (i.e. state) or « Communal » (i.e. city) level, which AFAIK isn’t affected by this.

[1] https://github.com/swisstopo
[2] https://github.com/MeteoSwiss
You have to reload the whole page.
You’re strawmanning. I was caricaturing the call for efficiency by blowing it up into a monster. I wasn’t saying I want to ban fulfillment of desire, or saying that’s the only alternative to the status quo.
it is worse: i think they also did not test random access. I suspect their test was to: fill PSRAM linearly and then read it back and verify linearly. Random word accesses in unachached mode also randomly lose writes. I am unable to replicate quickly on purpose, only randomly, so i guess it is under 1/100mil so it is not in my list above. My workarounds avoid these crashes too though.
VT-x. You should get the name of the technology right before defending it. VT-d is the I/O virtualization technology.

When did it become customary to defend people making claims of security instead of laughing in their face even though history shows them such claims to be a endless clown parade?

How about you present the extraordinary evidence needed to support the extraordinary claim that there are no vulnerabilities? I will accept simple forms of proof such as a formal proof of correctness or a unclaimed 10 M$ bug bounty that has never been claimed.
The deets of the story Paul Graham and Matthew Prince are referencing - https://www.theinformation.com/articles/why-parker-conrad-wo...

Sacks threw Parker Conrad (former CEO of Zenefits and current founder of Rippling) under the bus a couple years ago and began waging a media war against Parker and tried to sabotage Rippling's fundraising.

They didn't see eye-to-eye on politics and business, but Sacks was on his board and was COO at the time.

The only reason David Sacks backed off was because Sam Altman and PG intervened and threatened Sack's friend Marc Andressen that they would end YC's relationship with A16Z if Sacks didn't back down.

P.S. - The HN comments about Parker's ouster at the time did not age well - https://news.ycombinator.com/item?id=11061992
Somebody educate me about the problem Packer would solve for you in 2024?
> Even on a later pentium

MMX helped a lot here, I remember my Pentium MMX 233 had no trouble playing games and playing music. To give you an idea of how crapy that machine was otherwise... it was a Packard Bell with an onboard ATI chip that barely qualified for 3D acceleration. The Pentium 166 (non-MMX) we had would chug on things that the MMX just didn't care about.

> I had to minimize throttle priority on my web browser because smooth scrolling requires a ton of juice. Still does to this day looking at power consumption on an iPhone.

This still to this day amuses me. Metal and DX12 both have calls designed to support this natively on the GPU by allowing the application to shift the rendered area of a very specific box (without rerendering the entire screen) and then render behind in the blank. As far as I know only Safari on iOS does this even close to properly and even then it has other iOS Safari related quirks around that that Apple refuses to fix.
This seems like something almost every government would have already done. Open source software means they aren't locked into a single vendor and can hire anybody they wish (including their own internal developers) to modify their software to meet their needs. With proprietary software, a company like Microsoft or Apple can change your software whenever they want and however they want even if that isn't in your interest.

From the perspective of a consumer, being able to hire your own developers to modify your software is basically useless. But this is very useful if you're the government and have relatively unlimited funds taxed from your subjects.
In college, our SoC design instructor told us that to pass the class, our modules should be better than ST's "which is not that high of a bar" :P
Wild, thanks for sharing. One theory would be that it increased your sensitivity to something in that area. I have a hard time seeing that just a memory would make you faint again.

Look, nothing in this world is guaranteed to be completely safe. We take risks all the time, otherwise we wouldn't get out of bed.

Never heard of anything like it though, so I'm going to assume it's not very common.
everything old is new again. i remember when someone at google started aggressively crawling del.icio.us from a desktop machine and i ended up blocking all employees...
Hilarious that it is 2024 and Apple are only now releasing a browser version of their maps. Reminds me of how god-awfully outdated Safari and iMessage are, but Apple pursues their walled garden policy regardless.
You don't have to go even that far to find unsoundness in flow.

const arr = ["abcd"];
const str = arr[1];
const num = str.length; // this throws
console.log(num);

For me, typescript is a pretty good balance.
> I doubt they would claim to solve the problem if they provided half of the answer.

Stranger things have happened
I think his point is a priority-first ordering, rather than either a general-to-specific or a specific-to-general ordering. Most people do one of the latter two.
Yeah I’m all for these things that I was calling “vanity”. I was only using the word vanity because the comment I was responding to used it pejoratively: “vanity projects”.
Microarchitectural attacks are an even bigger problem for shared-kernel multitenant systems!
Yeah, Rust is fast, or you can go the other extreme with Python if you can put the heavy lifting on native modules.
So… Lambda, Fargate, and EC2. The only thing you can't really do this with is EKS.

Like Firecracker was made by AWS to run containers on their global scale KVM, EC2.
We may be over-harvesting metals on ocean floor that support deep sea life
If you're paying rent for typescript, you're doing it wrong.
GP observed that either the profit margin or the input cost is absorbing the difference, so I think the logic holds well and you are in agreement :)
FreeOffice PlanMaker is an Excel clone for Linux and Mac. Not sure what corner cases it doesn't cover though.
This only addresses one kind of partition.

What if your servers can't talk to each other, but clients can?

What if clients can't connect to any of your servers?

What if there are multiple partitons, and none of them have a quorum?

Also, changing the routing isn't instantaneous, so you will have some period of unavailability between when the partition happens, and when the client is redirected to the partition with the quorum.
NASA hasn't found life on Mars yet, but the latest discovery is intriguing
Seems to be user agent.

~$ curl -v -A "Mozilla/5.0 (iPhone; CPU iPhone OS 17_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1" "https://maps.apple.com/?ll=41.77708546284588%2C-122.51487365..."

...

< HTTP/2 302
< server: AkamaiGHost
< content-length: 0
< location: maps://maps.apple.com/?ll=41.77708546284588%2C-122.51487365132222&spn=0.04999999999999005%2C0.11502863436983546
< expires: Thu, 25 Jul 2024 21:08:46 GMT
< cache-control: max-age=0, no-cache, no-store
Aren't 'new models' always technically just refinements of old models? isn't that the point?
From the article,

>Thus in 1970, the Microcomputers Plant was established. Located in Warsaw, it employed Polish workers but used British components and financing.

The British were involved in every step.
>C was a clear example of "worse is better" with some kind of topological defect in the design such that there's a circularity in the K&R book that makes it confusing if you read it all the way through.

Aww you can't just leave us hanging like this. What's the paradox?
Russian chef/spy planned "destabilizing" acts at Paris Olympic Games
Not an especially impressive flex, but I'm not above trying to dunk on people for misspelling things either, so I'm not going to high-horse you about it (obviously i am).

The history of KVM and hardware virtualization is not an endless clown parade.

Find a vulnerability researcher to talk to about OpenBSD sometime, though.

https://isopenbsdsecu.re/
How is it any different than installing the package via pip ? Not only most people won't check the source before running the code, but there is also no way to be sure that the code shipped by pip is the one you read on GitHub...