skysight-inc/HackerNews huggingface dataset:
This isn't a bug IMO.

If you know the hash of some data, then you either already have the data yourself, or you learned the hash from someone who had the data.

If you already have the data, there is no vulnerability - since you cannot learn anything you don't already have.

If you got the hash from someone, you could likewise have gotten the data from them.

People do need to be aware that 'some random hex string' in fact is the irrevocable key to all the data behind that hash - but that's kinda inherent to gits design. Just like I don't tell everyone here on HN my login password - the password itself isn't sensitive, but both of us know it accesses other things that are.

If github itself was leaking the hash of deleted data, or my plaintext password, then that would be a vulnerability.
Somebody made it for searching memes few days ago

https://www.reddit.com/r/selfhosted/comments/t33rx5/just_rel...
Humans take risks all the time to fulfill our desire to explore or see wondrous things. Travelling to space for example. Maybe all the other intelligent life in the universe is prioritizing survival.
Well, we had close to 0% a few years ago (for general purpose AI). I think it's not bad...
>Come on, this is not surprising.

Very cool that it is not surprising to you.

But to others (some are even in this thread!) it is both new and surprising. They unfortunately missed your 4 year old comment, but at least they get to learn it now.
That's simply not going to happen. The West isn't sending enough military aid to tip the scales, and this is an existential war for Russia and they are managing it well enough.
> Like, that has nothing to do with their intelligence.

Because they don't have intelligence.

If they did, they could count the letters in strawberry.
I've had the Blue Delta Amex card for 20 years as my "daily driver" but recently concluded that the miles benefit was just not sufficient vs. a different card that gave cash back. It takes years and years of purchases to build up enough miles to redeem for even a single domestic trip. Ultimately not worth it unless you're augmenting it with regular paid-travel and/or use a card with a yearly fee.

I will keep it around for "risky" transactions though, where I believe I may have to issue a chargeback, since Amex is very customer-friendly when it comes to chargebacks.
Long agent trajectories, especially with command outputs.
userid AT nodename was also common in the VM/CMS RSCS world of mainframes (and BITNET).
Good question. For a start, don't pretend that Nazi soldiers were a multiracial bunch. And don't do whatever Google did to generate clearly-incorrect output like this.
Never noticed it, but I'm interested; can you link some examples?
Using ThreeJS, Blender and React to Create an Ice Cream Kiosk
That is probably a lowball. Several cities lost 911 service. Hospitals lost critical systems during emergencies.

(Why those systems run windows + crowdstrike and are even connected to the outside world, I don't know)
Part of your credit score is the percentage utilization of your available credit. So you want higher limits that you'll never use in order to make that percentage smaller and thus your credit score higher.

Silly game but might as well play it.
Whitehall doesn't believe in ROI in the north and it's been that way for decades and decades. Well, that's they excuse they use anyway

Birmingham got lucky as it's just feasible enough to turn it in to a commuting city for London but other cities are too far
X redesigns water pistol emoji back to a firearm
Depends on how much you're willing to pay and how long you're willing to wait for them to be available.

The best carpenters will be making custom furniture and wood panels for mansions, and have multi-year waiting lists.

There are tradespeople who are excellent and available to mere mortals, though. But there's often a waiting list, and you may pay more. (I've had the best luck with auto-mechanics.)
I think this image explains it best: https://www-cdn.anthropic.com/images/4zrzovbb/website/1f0441...

I.e. Opus is the largest and best model of each family but Sonnet is the first model of the 3.5 family and can beat 3's Opus in most tasks. When 3.5 Opus is released it will again outpace the 3.5 Sonnet model of the same family universally (in terms of capability) but until then it's a comparison of two different families without a universal guarantee, just a strong lean towards the newer model.
Oh sure,

But in the context of the comment that sparked this,

>(A big reservoir of spent nuclear fuel consisting mainly of) depleted uranium is not explosive.

Is an accurate argument, right?
No change will take place because there is no incentive towards change.

One might say, well there was this huge outage, but in reality they will keep doing as they've done business as usual. They may spin up a new shell company, under a new name, and that will be far cheaper than devoting a budget to security in the first place. Rinse and repeat.

There has long been little to no liability for software flaws, and proving negligence is an uphill battle.

Just to clarify, System's Engineer's know how to build resilient systems that do not fail under most circumstances. It is only when corporate overlords decide to make the tradeoff of resiliency, for a little more penny pinching in the shares; that things like this happen.

It is a natural flaw of any centralized hierarchical system involving people. Corruption, Front of Line Blocking, are all just another term for Single Points of Failure.
Sure, I agree that not 100% of all bad decisions ever made by Sony Electronics can be blamed on Sony Records.

The number is not 0% either.
It depends on the actual root cause, gross negligence won't save them, regardless of what they put in the contracts.

From my point of view, one of the greatest problem for them is that they bypassed customers deployment policies.
Kalkhoff is well known and I enjoyed working on them because they use quality, standard pieces, everything is strong and well designed without any fancy custom made parts. Lowest prices around 1500€ and you definitely shouldn’t by a bike cheaper than that. By the way avoid startups that create the “revolutionary IOT magic bike“ most of them are fantastic in marketing but a pain to maintain.

That being said, the most reliable bike is a bike without motor. You get ~3x the quality of an e bike for the same price (because 2/3 of an ebike price is the battery/motor).
There are working 96 GB kits. Check the Framework forum and also reddit.
Blind ordering only made sense when Amazon customer service was top notch. That ended when Amazon started having profitable quarters and started Day Two.

Now I have to be paranoid about checking product details like if there are 3rd party sellers using FBA which potentially signals fakes. There’s no longer blind trust in Amazon for a lot of customers. I can’t just mindlessly buy stuff with the hope that Amazon customer service can take care of anything going wrong like they did years ago.
I don't think you're right about that.
People have been over this. If you believe this, you don't understand how LLMs work.

They fundamentally perceive the world in terms of tokens, not "letters".
Surprised at the comments minimizing this.

I've used github for a long time, would not have expected these results, and was unnerved by them.

I'd recommend reading the article yourself. It does a good job explaining the vulnerabilities.
Solaris is still ahead of its time on many things. I wish it were worth porting eBPF to Solaris.
Can you list examples? Or better, report them to the moderators ('Contact' link on the page footer)? I've reported some in the past, months ago, but haven't seen any recently.
What analysis was done or are we just talking about the data gathering?
Ask HN: Do computer-based glasses exist that replace progressive/bifocal lenses?
These computer-based glasses could just vary what you see in each eye rather than requiring you to look up/down to see far/close objects.
That's been an issue with ordering consumer electronics. I don't know if the item is refurbished, returned,or endorsed by the manufacturer warranty. I basically only order through the manufacturer or best buy these days.
Will Figma become an awkward middle ground?
In my experience, a blood panel doesn't cover everything typically. My A1C, Insulin, and fasting Glucose levels are all within normal range, but actually I have insulin resistance, likely genetic that wouldn't appear in my general panel for at least two or three more decades. This is common in people whose family history includes poverty or subsistence farming. I'm glad I have the resources to address this while I'm still a young professional with no children of my own to manage and full healthcare benefits including out-of-network, but I had to find my own specialists to investigate what was going on with me.
Show HN: Syncd – Typed SDK and CLI for Webhook Integrations at Scale
Hi everyone!

Thomas here - founder of Syncd. Syncd is a suite of SDK's, CLI's, packages, and dashboards that make webhook creation and management super easy (especially at scale).

Previously, we specialized in logging and OAuth token management for internal webhooks. Now, we’ve expanded our offerings with a fully typed SDK that allows you to easily register and manage your customers’ webhooks (not just your own internal).

With just a few lines of code, you can now build a comprehensive end-to-end webhook integration for your customers (for example - Airtable webhooks or Jira webhooks). Once you use the SDK to create a webhook (either internal or on your users behalf) all of this is setup in the background:
- logging
- custom retry schedules
- custom headers
- security for SSRF and replay attacks
- rate limiting
- local tunneling via our CLI (no more NGROK urls)
- importable webhook endpoint types (no more manually generating types)
- Zod schema validations
- importable hooks (so you don't have to interact with a providers REST API)

I’d love to hear thoughts and suggestions!
The prices for items in my Amazon cart change multiple times per day.

Until they figure out price stability for staple goods then nobody will use this. Hell I don't even use Subscribe and Save for the same reason.
Completely depends on the program of study and school. In astronomy and physics programs, graduate courses are far more advanced, but grades are based almost entirely on homework sets. Undergraduate course are less comprehensive, but have a mix of homework and tests. Working on problem sets is chronically hard, while tests are acutely hard.
That's counterintuitive, though - often, the whole point of a hash is that it's one-way.
Can you please elaborate on what the political activism in the above comment is?
Use of LLMs/AI costs energy, and the public is indirectly paying for it one way or another.

Generalizing somewhat but focusing on a single company:

https://www.statista.com/statistics/788540/energy-consumptio...

In 2022, Google consumed 22.3G Watt-Hours of energy.

Total electricity consumption by humanity:

https://www.statista.com/statistics/280704/world-power-consu...

In 2022, it was 26T Watt-Hours.

Now, Google is a single company, and if we extrapolate with some cocktail-napkin math, let's say that similar tech giants put together consume, say, 20x Google? 50x Google? So between 2% and 6% of all human electricity consumption.

I realize that's not broken down for AI, but I'm sure if we do break it down we'll find that's an increasing fraction. In this article:

https://cse.engin.umich.edu/stories/power-hungry-ai-research...

the quoted figure is 2% of US electricity usage.
CrowdStrike to implement new checks to avoid another global IT outage
Well, looks like the rebuild of the Euston Arch will be delayed again.
It would be better if Alexa could have shopping lists. "Alexa how much is a box of tide pods? .... Okay, order me the large box with free shipping please." That would be pretty useful. And any subscription good you've already signed up for would be pretty helpful as it would be nice to manage them with a voice interface. But I don't know if it generates billions in revenue.
That's truly some dark comedy.
don't get me wrong, it is silly, but also being able to set a timer without touching anything with your gross cooking hands is unironically a wonderful feature.
And people were afraid of them achieving AGI
I've worked on the construction of a large dam and I think that's the case for most modern technology. Obviously once a dam is up and running it's really stable compared to what goes on in a fab, but getting it built? That's a whole other story.

The math and engineering behind dam construction are well understood but actually getting them built in practice is a years long story of yak shaving, cat herding, and trying to overcome every little piece of BS nature has to throw at the project. Unique and predictable geological conditions, unknown underground water sources, unexpected soil composition changes, surprise fault lines. Then there's the logistical nightmare of actually moving all the equipment in and earth out, the weather and environmental factors that impede every action, humans ignoring safety altogether, and so on and on. All of this implemented by workers on the ground who just barely know what's going on (for no fault of their own).

I'm continually surprised that anything complicated ever gets built at all.
Pog rides like Indurain, staying in the saddle and just punching the watts, that's nothing new. Ullrich adhered to that style and was handily beaten by Armstrong, because Ullrich couldn't match Armstrong's intermediate sprints out of the saddle. Maybe Ullrich's style is actually superior and Armstrong simply had the better juice, we'll never know.

These are just stylistic issues which might bring you a percent or two. The 10% we are seeing now is a world of difference on that level, especially because Pog simply exploded this year, beating both Giro and Tour without much trouble. I also heavily disagree with entertainment being the highest meaning of sports, because then I guess we would just all watch WWE or Peter Thiel's mutant games, but that's a topic for another day.
These are deeply insulting. My company sometimes sends out $10 cards for DoorDash. To actually get something I would have to add at least another $10 myself.

I wonder if Uber Eats and DoorDash give these out for free to companies as promotion. I bet most people who use the cards spend another $20 or more.
Lawsuits may crater CrowdStrike. I'll be surprised if they carry adequate insurance against this large a screwup.
https://archive.is/V0KGl
How do they technically implement this? Custom font? Or replace every emoji with an <img tag?
I wish that websites would stop overriding the emoji icons and just use the platform default.
> If you know the hash of some data, then you either already have the data yourself, or you learned the hash from someone who had the data.

Don’t think so - the article mentions you can use the short prefix on GitHub, so you have a search space of 65536.
>If you know the hash of some data, then you either already have the data yourself, or you learned the hash from someone who had the data.

From the article, you do not need to have the data nor learn the hash from someone who had the data.

>Commit hashes can be brute forced through GitHub’s UI, particularly because the git protocol permits the use of short SHA-1 values when referencing a commit. A short SHA-1 value is the minimum number of characters required to avoid a collision with another commit hash, with an absolute minimum of 4. The keyspace of all 4 character SHA-1 values is 65,536
Today in "random number pulled out of someone's ass"
2 things

The most important, kamikaze is a term used specifically for a human terminaly guiding themself along with their bomb onto the target. This is what made it so horrifying, If you are doing it remotely, it is not kamikaze, if a computer is guiding, it is not kamikazi.

Secondly, Why invent a new term? If I asked "what do you call a device that is launched, autonomously guides itself to a destination, then explodes" the answer would be a "guided missile", this term has served this role well for many years, drones were unmanned aircraft used mainly for reconnaissance or training/target duty. When you strapped a bomb to it, the term for this sort of unmanned aircraft was "cruise missile"

This is also my problem with the term "motor doping". doping makes absolutely no sense here in any previously used form of the word. When the magic low friction swimsuit was developed then banned, nobody called it cloth doping. the banned brush spike for running shoes, nobody called it shoe doping. Just because you are cheating does not make it doping.
Phoenix APUs work just fine with 48GB SODIMMs (I have AMD Ryzen 9 7940HS with 16GB soldered and 48GB on a stick, outside of NUMA weirdness it's fine)
Unrelated, but another interesting one is any non-admin contributors being able to add (and I believe update) secrets in a private repo for use in GH actions. It can’t be done via the UI, but can be done via the API or VSCode extension.

When I looked into it a while back, apparently it is intended behavior, which just seems odd.
composer within cursor (in beta) is worth a look: https://x.com/shaoruu/status/1812412514350858634
Love this part:

CrowdStrike said it also planned to implement “a staggered deployment strategy” for updates similar to the one that triggered last week’s outage. They would be “gradually deployed” to reduce the risk of large numbers of computers and servers being affected by an error at once, it said.

A little late.
What were you expecting it to do instead?

Edit: Why the downvotes? This is a legitimate question
the CPU in framework 16" will happily run 2x48GB SODIMMs.
> Small businesses somehow are more inventivized to do this than institutional investors? Because the margins are not sufficient to attract the large businesses?

Yes. When Joe is buying a couple homes, he doesn't have to pay for HR, business dev, legal, compliance, etc etc. And -

> That needs evidence.

Fair enough! I care about this topic, but not enough about this thread to make a carefully cited case here (no offense to you, friend). I'm sharing from anecdotes and personal (albeit unscientific) research.

> Someone buys a two flat, lives in one and rents the other to help pay for the mortgage. That has classically been ok. You're only objecting to the short term ones?

Yep, and I've come around on this. I used to think landlord = bad (in college, we're all young and naive at some point), but I've come around to the real economic need for an LTR market. I'm thinking of cases where an individual buys up a handful of properties to use as STRs, removing them from the LTR market (which reduces supply which increases rates of the remaining units). I have seen this happen in my area in real time but I recognize that it is scientifically unsound to extrapolate that to other areas.
It's interesting that Microsoft started with a toy gun, then someone around 2015-2016 made the decision to turn it into a real gun.
I like the Samsung 2018 design where you can't really understand if it's a toy or a futuristic ray gun.

... but more than that, I don't like how they keep playing with those designs all the time.
I like the idea. Small nit: the scrolling is a little unintuitive.
> If you know the hash of some data, then you either already have the data yourself, or you learned the hash from someone who had the data.

You need to read to the end of the article where they show the brute-force way of getting the hashes.
A more elegant emoji, from a more civilized age.
The original 'ps' got the data by reading kernel memory directly (/dev/kmem or /dev/mem), and I'm old enough to remember systems doing that. I don't think there were any Unix-derivatives that used system calls? Minix is closest, in that you could query the 'mm' task using RPCs which are sort of system calls.
I think the Roadster predates the Leaf by about 2 years? My memory of the era was mostly people saying how they thought batteries were a dead end and hydrogen was the future, but that may have been marketing rather than engineering doing the speaking.

I think SpaceX is meaningfully different than Tesla; even now, Musk seems to display a substantially different personality with regard to SpaceX vs. everything else — the similarity is the optimism, sure, but in he's a lot more willing to say "this is hard and I will make mistakes".

As for how hard the SpaceX stuff is: all I can do there is look at all the rocket companies and space agencies that were openly laughing at what SpaceX was proposing to do. I think SpaceX is where the market proof is for that, rather than the other way around.

Based on what I've heard from civil engineers and neuroscientists, with regard to TBC and Neuralink they regard him much as the annoying speaker with no self-awareness in https://xkcd.com/793/

FSD sounds like what happens with time estimation for someone new to software engineering projects — you have to take what they say, double the number, and increase to the next highest unit: "1 day" means "2 weeks"; "3 months" means "6 years"; and if someone says "next year" in 2016, pencil 2036 into your diary.
Most everyone in the personal computer space still. E.g. 23Q4 Intel held 78% of all desktop and laptop CPU sales (include ARM MacBooks and Chromebooks)

https://media.licdn.com/dms/image/D5622AQHZXLE-cipmBA/feedsh...
- Non-saturated response: response time when the CPU queue isn’t fully filled, simply said light CPU load situations

- Saturated response: response time when the CPU queue is (nearly) fully filled, simply said heavy CPU load situations

- Fairness: does every task get an equal slice of CPU time / processing

BORE stands for Burst Oriented Response Enhacements. Basically what it does is tweak the underlying CPU scheduler to give bursty CPU tasks higher priority. This translates to less lag when you say alt-tab out of a game or bring up a game overlay.
I support this. Bonus points : you can revert back to a normal bike whenever you need and you can swap motors for replacement/upgrade. Beware to use a frame that can handle the motor power.
Well, it looks like you are in the wrong output then. That is not what most people here believe.
>one of the greatest problem for them is that they bypassed customers deployment policies

Caveat emptor. Falcon and other similar security products often push updates at-will, and they're fully transparent about this if you actually read the contract terms and understand the vendor's approach to operations. I have worked with many clients that elect not to use such tools in certain sensitive environments, specifically to mitigate the risk of being impacted by something like CrowdStrike's 7/19 event.
Wow. Microsoft's original version was a pretty good compromise. (they used a futuristic blaster icon)
I have my cards on auto pay on due date. Works perfectly.
Wow they're working on really important and consequential things over there at Twitter under new management.