skysight-inc/HackerNews huggingface dataset:
Direct post to the blog:

https://blog.knowbe4.com/how-a-north-korean-fake-it-worker-t...

I'm a little skeptical of this orgs hiring practices in the sense that nobody met this guy, they hired him and some of the details are a little vague like:

- Background check appears inadequate. Names used were not consistent.

- References potentially not properly vetted. Do not rely on email references only.

I'm wondering, was their background check effectively outsourced and it came back good or bad and they just accepted it?

Considering how many people are sometimes involved in hiring I can imagine that some folks just run the background check and everyone sort of ignores any strange signs and assumes someone else will look closer.
It's a bug bounty, not a "only if we have time to fix it" bounty.

He found a security problem, they decided not to act on it, but it was still an acknowledged security problem
If you have root of course, you can do anything, BUT -- could a eBPF module be loaded into the kernel to just filter the syscalls to hide some nefarious process? This simplifies the 'evil VM' attack. Does eBPF have anything that could plausably help with that?
Absolutely. That's what you see in the videos. Finally one person starts really running, and it prompts the others.

I think of it as the National Park discontinuity: few people these days have experience being in environments that can be rapidly lethal.

And there isn't a sign in National Parks saying "Past this line, there are apex predators, dangerous natural features, no cell phone service, and/or the nearest medical facility being a backcountry airlift away."

That's a big change from most people's everyday normal.
Whenever I see a post like this, I wonder why the poster didn't just return the non-working part to the vendor they bought it from. This might be my US bias, but very few vendors put it on the customer to prove a certain level of testing and diagnostic activities; if the customer says it didn't work, the customer gets their money back. If you're not sure if it's the motherboard or the CPU or... return it all, and try again. No?
That's partly because all voice assistants have a feature discoverability problem. People have generally no idea what it can do unless they ask. And if new features are added, they won't know about those either. But at the bare minimum you know it has timers and weather.
Reminiscent of Terrence McKenna's Stoned Ape Theory:
https://en.wikipedia.org/wiki/Stoned_ape_theory
> Small shops, cafes, restaurants, even chains in London refuse to take it

I’ve never noticed it, but I’m admittedly speedy when I travel. Maybe the high-end spots keep it while lower-end ones are walking away? Makes sense with e.g. eBay.
See also: "Elon Musk's X adds pro-Trump icons for Trump hashtags" (https://news.ycombinator.com/item?id=41020124)

Twitter is just a barely disguised Truth Social now.
> None of that is copyright infringement, and scraping that same content to train an AI is no different.

Scraping is copyright infringement. Try telling the RIAA that scraping songs from YouTube or Spotify is not copyright infringement. Try telling the MPAA that scraping movies from Netflix is not copyright infringement. Same for book publishers.
I'm with you on that one. I think that was an indicator of how political sentiment and goals seems to have shifted at one point from "reconcile differences and eventually just feel as one human race" to "emphasize differences and pledge allegiance to whatever group I belong to".
Zizek said it best: every culture war is today's conservatives fighting the conservatives of 30 years in the future.
I don't see why not - that's just reading from /proc/mounts.
That seems promising, I only require arm runner currently.
Ubicloud has GitHub Runners on AWS right?
Because it's the change that's stupid.
> Sort of a synonym for "virtue signalling" it seems?

I genuinely have no idea what that term means anymore.
Why do we have to "get there?" Humans use calculators all the time, so why not have every LLM hooked up to a calculator or code interpreter as a tool to use in these exact situations?
I raised concerns about deficiencies of their RBAC on their Slack before and they immediately started pushing me to their enterprise offering. I thought it was a red flag but have not imagined they would stoop to this.

When we started using them they seemed like a genuine open source. Is there a term for open source traps like that? If not we need to come up with something. Trapware?
Vanta raises $150M Series C, now valued at $2.45B
Elasticsearch being strongly typed I think creates a lot of overhead since you need to manage the schema for all your logs. Loki only expects certain (indexes) fields which are key, value pairs so you can throw all kinds of data into it and only mess with schema when you're querying
Don’t forget machine-translated texts, where until ~2017 the translation was likely done by something much dumber / semantically lossy than an LLM, and after 2017 was basically done by an early form of LLM (the Transformers architecture originating in Google Translate.)

Many historical English-language news reports published on the English-language websites of foreign news media from non-English-speaking countries, from 1998 (Babelfish era) to ~a few months ago, may be unreliable training data for this reason.
> For the first two, git is based on content addressable storage, so it makes sense that anything that is ever public will never disappear.

No one can, with a straight face, say that they don’t restrict access because “this is just how the technology works”. Doesn’t matter if it is content addressable or an append-only FS or whatever else.

Even for some technology where the data lives forever somewhere (it doesn’t according to Git; GitHub has a system which keeps non-transitively referenced commits from being garbage collected), the non-crazy thing is to put access policy logic behind the raw storage fetch.
> I’m no security person, so the reasoning felt a bit weird to me, as I guess the .zip TLD can’t hurt anybody; downloading a .zip might, which you can attach to any link name? But in any case I wasn’t able to find any .zip URL with a purpose, but lots of Reddit posts of angry sysadmins who bemoaned the influx of terrible TLDs with mostly phishing use and vowed to block them all. So they probably have a point in downright blocking the whole TLD.

The problem is auto-linkification. It is extremely common in forum posts or emails to refer to attached filenames. Most forum softwares or email clients are helpful it automatically turning obvious URLs (doesn't start with a protocol:// but ends in a .tld) into clickable links. Anybody's reference to a zip filename is now a clickable link, only waiting to be registered for phishing attempts.
The official name still is just "pistol" (and even more the latest Unicode standard specifies it as handgun, revolver). Not sure how Emojipedia decides on used name (seems to follow Apple) but (in this case at least) isn't using the standard one.
I find the mental overhead of tracking categories to be extremely irritating and I have just stopped using the discover card.
> Modern CSS and your JS frontend of choice is a lot quicker and more powerful for component building and general design work.

I'm a former designer turned programmer, and I couldn't agree more. I was recently tasked with doing some mockup images (no official designer on the team), and at the end, I realized that I could do it so much faster with code.

Ironically, while I was putting the images together (I used Affinity Photo), I remember thinking to myself "Does this thing have some sort of scripting language?".

I still think a sketchpad and a pen is the best way to generate ideas. But, when it comes to mockups, good old HTML and CSS really can't be beat.
I guess that's what happens when you're generating absurd amounts of revenue and want to "reinvest" it all: anything that even vaguely smells of "innovation" gets money thrown at it like crazy, and you end up incentivizing bullshitting.
The amount of jokes, memes, and legitimate threats I've seen with the "water gun" emoji far outnumber the number of people using it to represent an actual water gun.

In fact, I can't recall a single time I've seen it used in the context of water guns.

People posting "<Skull><Water_Droplets><Water_Gun>" on Twitter/TikTok/whatever are just doing the emoji equivalent of saying "I'm gonna shoot this guy, in Minecraft."

Is it really better that the emoji is technically not an actual pistol? Is that gonna be the thing that stops people from making threats online?
As far as I understand, it is already mainlined, it's just not built by "desktop" distributions since nobody really cares - all the cool kids want dbusFactorySingletonFactoryPatternSingletons to undo 20 years of hardware performance increases instead.
Much of the moderation on HN is by the community through flagging and voting, the mods can not possibly read every single comment. Overall it works pretty good and having a bunch of grayed out comments at the bottom of a thread is hardly a problem. The examples given above show the users responsible are limiting their posting to once a day or so probably to evade triggering any automated warnings that would get the mods attention, so it is up to the community to report them. Not that a ban is going to accomplish much, pretty easy to setup a new account.
Tim Cook can definitely fuck off with that water pistol nonsense.
It also applies to this situation:

1. Create a private repo R
2. Create a private fork F of R
3. Push commits to the fork F
4. Make R public

The commits pushed to F prior to R being made public will become de facto public, even though F has always been a private fork. The post makes clear that commits pushed to F after R is made public are placed into a separate, private fork network.

So basically, if you ever intend to open source anything, never do it to an existing private repo. Always start a from-scratch repo to be the root of your new public project.
Usually, to trigger any kind of anti-trust law, you need to have massive market share. In this case, for example, Reddit almost certainly hasn't committed any antitrust violations, because they're a relatively minor player in their market.

Similarly, if you start a vacuum cleaner company, you can make whatever exclusive deals you want. But if you control 80% of the market for vacuum cleaners, then you might need to be more careful about leveraging your market share in unfair ways.

If a company is part of a robust, competitive market (like Reddit), it's usually wiser to let customers vote with their wallets, and leave the government out of it. If a company becomes massively dominant (like Google or TicketMaster), and if it starts pushing exclusive contracts, it's much harder for customers to switch away.
Your avoidance of death would be far better served by protesting endless wars and AI weapons, not stochastic parrots
The unicode spec has always, and will always, have it as a pistol.

Stop destroying standards because they hurt your feelings.
They mentioned they do dogfooding. Wonder why it did not work for this update.
How did Microsoft take Mistral out? I missed that.
New accounts are only default shadowbanned when created from a known VPN IP or a known "bad" IP for which user creation isn't yet banned. The shadowban expires after a couple months (?) which is why sometimes you'll see accounts making their first visible comment even though they were created some time ago.

Accounts with a high comment flag rate are timed out. New accounts with a sufficiently high comment flag rate are permanently timed out.

Accounts likely operated by known trolls are manually shadowbanned.
Well it can take some time to learn to be nice!

But it doesn't take any extra time to give friendly and appropriate feedback in a code review.

If someone is so fragile, that they cannot accept feedback in their code review, then they are the jerk.
And there is only the one kernel. No easy rollback option at boot, a previous version to at least get the system online.
Umbrella Term is a optimistic description for something so nebulous and used so frivolously. It is more commonly used as "anything I don't like is woke" and "any opinion that doesn't match mine is censoring me."
This would help against basic ps commands but if your security tool reads the task's PF_ flags (from /proc/PID/stat or kernel memory), you'd still see that your [task] is not an actual kernel task... (the PF_KTHREAD flag is 0x200000):

$ ln -s /bin/sleep '[kernelstuff]'
$ ./\[kernelstuff\] 999 &
[2] 29499

$ awk '{ printf("%x\n", $9) }' /proc/29499/stat
40400000

$ pgrep kthreadd
2

$ awk '{ printf("%x\n", $9) }' /proc/2/stat
208040

Edit: as you said, it's superficial disguising (that may even work in some cases)
What crown?
The original colored Google emoji (known as flour sacks, blobs, or gumdrops) had personality! Something like 7 years ago, they were neutered in favor of something much more generic; presumably, to make them more closely connote the meaning imparted by iPhone senders.

The only one I can think of that's visibly different now is the melting face. I wonder at what point it too will be changed to match Apple.
then it's fine

the issue is the `fork` mechanism of github is not semantically like a `git clone`

it's more like creating a larger git repo in which all forks weather private or not are contained and which doesn't properly implement access management (at least point 2&3 wouldn't be an issue if they did)

there are also some implications form point 1 that forks do in some way infer with gc-ing orphan commits (e.g. the non synced commits in he deleted repo in point 1) at least that should be a bug IMHO one which also costs them storage

(also to be clear for me 2&3 are security vulnerabilities no matter if they are classified as intended behavior)
hype, marketing, investors spent millions so lets make it happen.

It feels a lot like the whole crypto thing
Concrete homes want to take over your subdivision – Fast Company
The dev was probably the CTO for several years. When Dane stepped down from the CEO position he asked Rajesh if he wanted to take over.

Dane used this process over ten times. Paperless Pipeline is probably the most successful example and semi-documented.

---

I think if you offer an appealing opportunity, you don't have to offer the most money. There are many other things you can offer (as outlined in that PDF).

Recently I almost took a project for 40% of my normal rate. Fortunately things worked out and I negotiated 80% of my rate, even though I should probably increase my rate.
One Bitcoin wallet among a suite of privacy offers doesn't mean they are turning into one and I disagree they are throwing most of their loyal users under the bus.
Fun post, but I'll state the obvious because I think many people do believe that every Windows machine BSOD'd. It was only ones with Crowdstrike software. Which is apparently very common but isn't actually pre-installed by Microsoft in Windows, or anything like that.

Source: work in a Windows shop and had a normal day.
Update: I asked again if -1000 is even or odd, and Alexa continues to think negative numbers can never be even or odd.
Getting designers willing to setup their workstation to hand code a React app with dozens of dependencies and be constrained by the DOM is not going to go very well. And then doing it all over again with several other web libraries/languages. This is not even design, it's a developer role who just happens to paint UI with code.
Prime is Amazon's moat though. More than 100 million people subscribe to a service that locks them into choosing Amazon first. People with Prime choose Amazon over going to a physical store. It's what took Amazon out of being an e-commerce business and into being a retail business. Don't underestimate how important Prime is to Amazon - it's literally a vendor lock-in that generates billions directly through fees and tens of billions indirectly through additional sales.
> But you know what AI will be great at?
> ...Turning wireframes into frontend code (limited logic)
> ...Wielding (and extrapolating) your design system
> ...Creating beautiful visuals from screenshots and mood boards

I don't think the argument works. It imagines AI will be able to do things that our current AI do not.

Our current AI work in terms of what they've been trained on. Natural language to code works as well as it does because coders have been asking and answering questions about code a lot on the internet, that's been collected into data sets, and those data sets have been used to train LLMs.

For AIs that work like our current ones to be great at the things the author envisions, they will need a lot of examples of those things, and of a high quality too.

The author wants AI to turn natural language into wire frames, let the designer adjust and improve the wireframe, and then turn the improved wireframe into production code.

But I don't think the training data for those two transformations exist. What even is the intermediate wireframe format? AU will produce and consume it, but it also needs to be in a form human designers can iterate on.

Since the training data doesn't exist, it would need to be created. Is that feasible? If you can't harvest the internet for it for almost nothing, it would cost a great deal to create, and I wonder about the quality of the result.
What is this company doing that hasn't already been done to death? Nvidia has the Shield, Google TV with Chromecast can also run games and connect to external controllers, and so can the Fire TV and Apple TV. With modern streaming options like GeForce Now or Xbox Cloud Gaming or PSNow, you can also play AAA console games from any web browser and controller.

None of those require a special stack. Gamepad support is built into both Android and web browsers already. You can connect any Xbox or generic Bluetooth controller to your phone or Google TV, etc. and play some Android games with them.

Meanwhile standalone consoles like the Ouya, Stadia, Razer Forge TV, and others have all tried to do that and failed.

OP, sorry for being harsh, but I feel like this has already been tried so many times :( Is this new company really offering something different?
3-D genome architecture persists in a 52,000-year-old woolly mammoth skin sample
Combined with this, presented as a change they could potentially make, it's a killer:

> Implement a staggered deployment strategy for Rapid Response Content in which updates are gradually deployed to larger portions of the sensor base, starting with a canary deployment.

They weren't doing any test deployments at all before blasting the world with an update? Reckless.
Yeah. My European colleagues always have super long vacations during the summer so we all envy them :D Plus the pay is not bad comparing to Canadian.
I just tried Copilot
2 ‘r’ in strawberry,
3 ‘r’ in strawberries.
Doesn't support Firefox on Mac...
I never have to switch languages just to type a word or two in another language into the keyboard. Switching keyboards is very fast from the button on the keyboard, but switching isn't even really necessary to type in multiple Latin alphabet languages. For me it even autocorrects and spellchecks correctly with mixed English-non English text regardless of the enabled keyboard. What do better solutions look like?
You’re right that they don’t let commits get GC. They jump through hoops in order to keep commits that are not transitively referenced from being garbage collected. Just assume that every commit is kept around for “auditing”.

One GitHub employee even contributed a configuration to Git which allows you to do the same thing: run a program or feed a file which tells the GC what nodes to not traverse.
space ex -> space sex? It's literally one consonant sound away, not a "stretch" in any dialect of English.
Vote for politicians that campaign on consumer protection legislation.

Here in Europe, it's been mandatory to show a price related to a reasonable common base point (e.g. liter, kilogram, piece, usage-unit for laundry detergent) adjacent to the actual product's price for many years now. You can go and use 1/10/100 grams/milliliters though for small scale packages where that is reasonably common (e.g. spices), and that's it.

Fun fact, that piece of legislation significantly contributed to Brexit propaganda, the campaign was based on "the EU wants to take away our pints/stones/pounds/whatnot".
Even more, fonts having multiple colors in a glyph was a huge complexity explosion for font rendering, for terminals, and more. You can see a very quick technical summary of different ways of encoding colors in fonts here: https://en.wikipedia.org/wiki/OpenType#Color_fonts

But anyway, images should have remained separate things, png or whatever. Fonts rendering is complex enough with complex scripts e.g. Arabic, but that is the domain of fonts/shaping/rendering.

Such a hugely expensive technical mess because people want their stupid color emojis.
It will keep happening the same way languages gradually change and for exactly the same reasons. Being in flux isn’t a bug, it’s the content of culture.

Doing the stuff differently compared to /the other group/ to know you belong to /this group/ is everybody’s favorite game.
> it also requires that you know the commit IDs, which is not something you can get via brute forcing the API

Well, GitHub accepts abbreviations down to as short as four hex digits... as long as there's no collision with another commit, that's certainly feasible. Even if there is collision, once you have the first four characters you can just do a breadth-first search
> Aoccdrnig to a rscheearch at Cmabrigde Uinervtisy, it deosn't mttaer in waht oredr the ltteers in a wrod are, the olny iprmoetnt tihng is taht the frist and lsat ltteer be at the rghit pclae. The rset can be a toatl mses and you can sitll raed it wouthit porbelm. Tihs is bcuseae the huamn mnid deos not raed ervey lteter by istlef, but the wrod as a wlohe.

We are also not exactly looking letter by letter at everything we read.
Is the difficulty because the sensing techniques give general but not-localized results? I.e. porosity in an area, but no information about specific connected fissures? Or something else?

My cousin is in hydrogeology as well! Fascinating subject!
Prohibition outlawed manufacturing, selling, transporting, importing, and exporting ethanol, not consuming it.
Even worse, the Emoji descriptions (on some platforms) don't correspond at all to what the emoji actually represents.

For example, the " " emoji, described by Unicode as "health worker" is called "non-binary doctor" by Apple.

If you send that emoji in a text to somebody, and they're e.g. using accessibility software, wearing AirPods and have notifications read out to them by Siri, or have their phone integrated with CarPlay etc, the message they'll hear is very different from what you actually intended to say.
Ask HN: What registrars are in use with startup and big tech domain holdings?
Namecheap has stopped supporting some TLD transfers in, now referring users to their spaceship property instead.

Uniregistry was bought, and shut down, with all domain management transitioning to Godaddy.

Gandi made their 2.0 dashboard feel like a padded room.

All registries have raised renewal prices with no value added to justify it.

Who is using what? Who is hosting bigger domain holdings? I am trying to consolidate domains I have spread across a few, and would like to gain some insight to other options.
Or moving from RCS to CVS.
It's $150k in 2024 dollars assuming 40 hours/week, which I would consider pretty decent for a minimum - a bit above median depending on who you ask.

The document itself I agree has some parts which are a bit over-the-top but that's probably the case for all hiring advice. When you list the qualities of the perfect candidate out on paper it's guaranteed to look ridiculous.
It's not like words have unambiguous meanings, it's not a new problem.