skysight-inc/HackerNews huggingface dataset:
Where does CISA/NIST recommend (for software developers) or require (for government agencies integrating software) specific software/operating system hardening controls?

* Where do they require software developers to provide and enforce seccomp-bfp rules to ensure software is sandboxed from making syscalls it doesn't need to? For example, where is the standard that says software should be restricted from using the 'ptrace' syscall on Linux if the software is not in the category of [debugging tool, reverse engineering tool, ...]?

* Where do they require government agencies using Kubernetes to use a "restricted" pod security standard? Or what configuration do they require or recommend for systemd units to sandbox services? Better yet, how much government funding is spent on sharing improved application hardening configuration upstream to open source projects that the government then relies upon (either directly or indirectly via their SaaS/PaaS suppliers)?

* Where do they provide a recommended Kconfig for compiling a Linux kernel with recommended hardening configuration applied?

* Where do they require reproducible software builds and what distributed ledger (or even central database) do they point people to for cryptographic checksums from multiple independent parties confirming they all reproduced the build exactly?

* Where do they require source code repositories being built to have 100% inspectable, explainable and reproducible data? As xz-utils showed, how would a software developer need to show that test images, test archives, magic constants and other binary data in a source code repository came to be and are not hiding something nefarious up the sleeve.

* Where do they require proprietary software suppliers to have source code repositories kept in escrow with another company/organisation which can reproduce software builds, making supply chain hacks harder to accomplish?

* ... (similar for SaaS, PaaS, proprietary software, Android, iOS, Windows, etc)

All that the Application Security and Development STIG Ver 6 Rel 1[1] and NIST SP 800-53 Rev 5[2] offer up is vague statements of "Application hardening should be considered" which results in approximately nothing being done.

[1] https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_ASD_...

[2] https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.S...
Dont forget the invention of open spaces!

Open spaces is proven to be inferior to closed offices, but cost cutting and flexibility in layout is most important for HR.
Not just Verizon; the literal FCC, who licenses and restricts what bandwidth can be used for what purpose.
Liability for a defective product is a “radical restructuring”? It’s something we have in almost every other category of business - not perfectly but pervasive enough that software is really conspicuous as an outlier.
It's not exactly about the privacy in public, though. YMMV, but I'm 101% fine if a camera looks at me and a machine processes the image. What matters is what happens afterwards.

Heck, I want an aid like that - my built-in wetware face recognition is barely functional (I don't even recognize actors in the movies, save for a few most iconic ones), and tying faces only works after repeating it a dozen times. I can pinky swear I won't be sharing this with anyone. I probably won't even keep records, because it's literal digital junk (but I'd like to have a right to record everything that happened around me that I could've possibly remembered naturally). But that's not about it - I just hate how mass surveillance made a lot of people hate all the cameras without making any distinctions (sure, I think I get it).

What this is about is that while individual privacy in public is not expected (save for stalking or other forms of harassment, which aren't exactly about privacy anymore), privacy at scale is an open question. Large entities, like governments or big companies, can collect unprecedented amounts of data, and at that scale it holds a significant potential both for good use and for abuse. So, in a functional democracy, it must prompt a public discussion and search for a consensus. It can be argued that there are benefits, and whenever benefits outweigh the risks, and it also can be argued that old principles must be still upheld to the letter, or if reality had changed too much and those principles are not matching to the ideas and reasons...

It especially matters when it's about the government, because government abuse can get really nasty, even deadly. That's why all the safeguards, checks and balances.

Basically, I think it's not really about cameras, it's about ability to build large databases with information that may be, uh, socially sensitive.
new article title: WSJ is falling behind on its bills!
> anonymous facial recognition

I don't have an answer to the specific question, but I have experience working on single and multi-camera person tracking systems and I can tell you that they highly focus on the faces for recognition[0]. There is no such thing as anonymous facial recognition or even person tracking. Data creeps in through things that can be later extracted, though you can make this process more difficult and that's about the best you can do.

For a non-technical intuition of this you might notice that you can often recognize a friend walking away from you (no visible face) down the street. Even if you don't know why you can recognize them, it is down to subtle things like the way they walk, dress, hair style, etc. It might be harder to identify people this way and more prone to mistakes, but even when less accurate you could significantly narrow down possible candidates (even more with correlating information like location and time).

[0] This was a surprising thing to me because I suspected clothing would be a stronger indicator especially when face isn't always visible but this could also happen for other reasons and can be highly influenced in pretraining. Even saw it with blurred faces in testing, but depended on how these were blurred. Gate tracking also seemed to be picked up but I never confirmed.
I receive $0 compensation for working on the D compiler. It's Boost licensed. Everyone is free to use it for whatever they want, and the source code is free to use, too.

I'm fully aware of what I'm doing :-)

The D Language Foundation is a non-profit, has expenses, and is funded by donations. None of it goes to me.
Can’t you embed images in html/js as base64 or binary?
Hint: she didn’t say that they were building them intentionally. Skimping is building a problem even if nobody had a Jira ticket saying they had to leave out bounds checking.
If a userspace process can't tell, then does it really matter? That's what qemu user teaches us. The Linux ABI is simple enough that a single dev could emulate probably 85% of it in pretty short order. What keeps Linux going is the supremacy of its internals. I've thought of so many ways to benchmark OS performance and I don't think I've ever seen modern Linux fare poorly.
That all said....

There's a lot of comparatively wealthy engineers and programmers out there. Enough to fund a powerhouse of a lobbying force. But lobbying to change what is the question?
Spyware Injection into ChatGPT's Long-Term Memory (SpAIware)
I confused Annapurna Interactive with Annapurna Labs. Was lost for a bit there reading the article.
CC debt is a net negative spending by consumers. The difference between outstanding credit card debt each year is far less than the money spent servicing credit car debt. Even if you adjust for defaults, it’s a huge drain on people’s spending.

Very specific industries like amusement parks see some gain, but overall the economy would be far better off with significantly smaller credit card limits.
My experience is the opposite. I bond with coworkers and get frequent job offers, career tips, and solid life advice.

We go hang out, go camping together, and watch each others kids,

It would be moronic to think coworkers will "automatically" be friends, but I have found work to be a great place to hunt for friends.

Also, it helps to have friends in a competitive environment. It can be very good for you and good for them. You just have to collaborate to boost competitive advantage against everyone else. Friends that will talk you up to leadership (with justification) is basically a workplace hack. Not to mention being friends with your boss or boss's boss. Extremely good for you.
I’ve done bursts that lasted for 2 minutes.
Struct layouts in C are defined by the platform's ABI, and in every sane platform, that just looks like "lay out each element in order, adding the smallest-possible amount of padding to satisfy alignment requirements" [0]. There are presumably oddball platforms which do something else, but good luck actually finding one that has lots of RAM, an ordinary filesystem, and so on. (Within the realm of sane platforms, there are a few alignment oddities, but it's always safe to build packed structs as if each type is aligned to its size.)

Struct layouts for FFI in other languages tend to follow the C convention and/or allow explicit field offsets to be specified. Regardless, if you use the proper language constructs, it's nowhere near as undefined as "whatever the compiler happens to generate".

[0] https://www.gnu.org/software/c-intro-and-ref/manual/html_nod...
>> , I'm not sure why it would be limited to donations. They can hire devs to work on FOSS.

These FOSS we personally use. And FOSS we don't. Most of the FOSS we use already has plenty of paid devs. Think Linux, Firefox etc.

But what about small projects? How does that hiring conversation go? How do I explain my hiring request to my supervisor? Why am I spending 100k a year on a text editor? Why have I mandated we use my cousin's text editor and we're paying him to write it? When there hasn't been a significant update in 2 years? When we had to layoff staff to make mandated cost cutting?
Does that body of literature say anything about in-person interactions in the workplace?

Specifically the workplace. An environment that a breathtaking number of people do not want to think one second about outside of work.
there are a lot of magnetic-particle FDM materials out there, I guess a project like this is waiting for a filament house that wants to start experimenting with magnetic powders + TPU.
Then they should ask for it.

"I give my software away for free and no one pays me for my work."

Your argument makes no sense.
Oh, give me a break.

You can still do all the same shit with iFixit tools. These are just the genuine tools aimed at repair shops.
If your application is Python or TS based, you can check out the DBOS libraries, which do that.
I’m with you on this.

As much as I love the many benefits of working from home—especially as a dad—I find the work experience to be hit or miss, often feeling low-quality.

You used to be able to have real connections with colleagues, but now almost everything feels superficial at best, whether through Zoom calls or disconnected Slack messages.

One thing I especially miss is whiteboarding sessions with a couple of smart colleagues as we work on a difficult problem; you simply can’t replicate that feeling digitally.
Sure, lots of people waste time in office too. I just see it a lot worse from friends and colleges who are hybrid and WFH.
> There are an estimated 10 million Americans living overseas

Curious how you found this number, have a source?

This made me pretty curious, but I couldn't find any official numbers. The closest 'official' numbers that I could find are from the Federal Voting Assistance Program [0] and that lists 4.4 million people, but only 2.8 million of those being adults.

[0] https://www.fvap.gov/info/interactive-data-center/overseas
People make choices all the time. Choices that are overseen by management, and shareholders.

People can of course choose to spend their political capital, and discretionary budget on random OSS projects. Or they can choose to spend it on their project, their goals, the outcomes that make their walk in the company easier, the actions that will get them promoted and not fired.

These are choices people make, and frankly OSS funding delivers very very little bang for the buck. (On a buck by buck basis.)
This has all been done before in mechanical, structural, and civil engineering. People die and then regulatory and industry standards fix the problems.

We do not need to re-invent the concepts of train engine, bridge, and dam standards again.

I mean, I guess we actually do. The issue is that software has not yet killed enough people for those lessons to be learned. We are now at that cliff's edge [0], [1].

Another problem might be that software influence is on a far more hockey-stick-ish growth curve than what we dealt with in mechanical, civil, and structural engineering.

Meanwhile, our tolerance for professional and governmental standards seems to be diminishing.

[0] https://news.ycombinator.com/item?id=39918245

[1] https://news.ycombinator.com/item?id=24513820

... https://hn.algolia.com/?q=hospital+ransomware
end up as journalists or literary critics or copywriters but those people do actually get a degree in liberal arts to do that.

Given what the major newspapers write and the major news networks broadcast, it's quite an indictment of their liberal arts educations.
Scott Manley does a good video here, but make sure you watch some of the actual inquiry for yourself.

You can pick almost anywhere in the current ~30 hours (5 days to go) and it's interesting.

This 10 min story for instance is full on, it's a bit leading and not engineering, so jump to some engineering talk as well -

https://youtu.be/B9tqlpARlqQ?list=PLgOje37c-b1NswzbM8kMEGRrd...

Get in now before people turn this into man-child story's like the "Hyatt Regency walkway collapse" or the "Citicorp Center engineering crisis" which are fake stories that HN and universities have on repeat.

And compare it to what the media choses to report on now, what do the art student journalists see vs engineers.
Got a 404. Try this URL.

https://www.eurasiantimes.com/unprecedented-security-awaits-...
Do you plan on open sourcing or letting us self host this tool? I would like to grab a bunch of videos but don't want to spam your server :)
I just want to piggy back here. There's often counter arguments about how laws say that when you're in public you have no expectation or right to privacy.

First off, this is not true, you definitely have some rights to privacy in public (an trivial example is using a public restroom). The law also is based on what is reasonable, and I don't think nearly everyone would think it is reasonable to expect some privacy if you walked down an alley to get away from others or went to a more secluded area. These are often explicitly why people do such things.

Second, recognize that many of these laws were written long before the average person had a camera and microphone in their pockets (not to mention high quality). The environment changed and it makes sense that our laws should change to. So even if you reject the first point these arguments about "what the law says" are still not enough to dispel concerns because we can in fact change the laws. More so, we _should_ constantly be updating laws due to our changing environments and how we learn about things as they happen.

And yeah, there's also a significant difference between a private person and a government doing these tasks. The government has a lot more power, and this does mean they require higher scrutiny and accountability even if you have complete faith in them (yes, this also means corporate entities, since the concern is power dynamics). Scale certainly has changed in the last 100, 50, 20, and even 10 years. It happened fast and no matter what side you are on, you can't ignore that things have changed and are about to change even more.
Have violations of this license been successfully countered?
Hm, sounds the same as the concerns about the fields of teaching, nursing, eldercare and childcare. Interesting parallel.
It's the same reason why it's difficult for single men to find a partner. Life has become too individual. Didn't Rick Beato just talk about this...

https://www.youtube.com/watch?v=h_DjmtR0Xls

I have a project. I'm willing to spend time to help someone learn how to contribute, and in return they'll gain experience they can use to earn money elsewhere. How do you find those people? It's the sales. We have saturated our tolerance for advertising. We just assume everyone who approaches us wants to sell us something right away.

When I started development on my accounting application, I decided to go around town and talk to businesses to figure out what features I should add. I had nothing to sell, I just wanted to talk to people about my own personal initiative. Never mind everyone on the internet screaming that an ERP system can't be done by a single person. No one wants to talk to me, no one cares.

And you all know the best of us are introverts because we focus on the problem and not the sale.

YCombinator: learn to do sales on your own, don't look for sales oriented co-founder. Seriously? Every day it's getting harder and harder to do sales. It's not even sales but social engineering. You hear words like "funnels" and "CPA".

I reached out to my network, I know about 7 people capable of helping me. None had the drive to lift a finger cause they're all too comfortable with their day jobs. I don't blame them, I would be too if I was being paid $100k to change background color of buttons every two weeks.

Yes, what I'm building is of commercial nature, but I have other interests too, like creating mesh network with ESP32 which to me has no commercial value and would be done purely for fun. I'm sure there's people with similar interest exist, but they're being kept guard by social media companies that work against collective initiative. Cause if they didn't, it would be too easy for people to find what they're looking for.

I have interview on 24th. If I get the job the progress on my project stops. I'm 1/4 ways through to production, that's three more years of development. If I had few people to help me, we could complete it in six months and end up with jobs maintaining it.

Like many people pointed out - time is precious, "you couldn't even pay me to do it", "I have a family".

So you have to find people just at the right time who have overlapping free time.

I've run out of money, gotta go back to work.

Increment this counter if you gave up on open-source: 1
Three axes in my mind to take into account: Likelihood, impact, and complexity. The article seems to mostly be about likelihood and complexity. I'd place more importance on impact and complexity. It's worth saving a headache later if it's simple to do right now, however unlikely it is, as long as it doesn't create a maintenance burden before that point.
I don't know how meaningful those countermeasures really are. Like, you're basically looking at the space of Linux kernel LPEs, and you're bringing it down to maybe 1/3rd the "native" rate of vulnerabilities --- but how does that change your planning and the promises you can make to customers?
> Why am I spending 100k a year on a text editor? Why have I mandated we use my cousin's text editor and we're paying him to write it? When there hasn't been a significant update in 2 years? When we had to layoff staff to make mandated cost cutting?

Wow. What absurdly unfair examples.
The upfront capital costs and fixed running costs are huge, and the commissions are very low - often zero, normally about $1 or $2, only very rarely $10+ if it’s a high-priced purchase (business/first class with multiple passengers, but that’s rare on a budget flight funding site). And because travel is an infrequent purchase for most people, you don’t get much of a retention flywheel.

This is why there are close to zero flight search engines that are successful standalone companies and almost all the big brands have been acquired by bigger dominant players - Kayak is now a sub-brand of Booking (prev. Priceline) and Skyscanner was acquired by Trip.com in China.

Yes they can be valuable properties but more as a traffic generator for selling other products (accommodation, car rental, insurance), and you need a big team to do all that.
there are ways to minimize memorization, most important:

1. keep log, docs, records of whatever you are doing. most commands are repetitive.

2. copilot or chatgpt, they help a lot with command lines and simple utilities

3. amazon Q sucks in comparison.

4. it used to be google, but now LLMs do it better. less scrolling and ads/spam.
I use non Linux systems for which docker desktop was the best way to have docker running without having to do much work.
Everything costs more in the US except for imported stuff. It's not because of corporate greed. It's because labor costs so much here, primarily.

>The problem with the NHS is due to the amount of budget cuts from the Tory government.

I don't know all about UK politics but I know that the current social programs and government spending are unaffordable. The US and other Western countries can't afford it either. The problem is not that spending is not enough, the problem is that our countries are not competitive or productive enough on the world stage for this exorbitant spending.

You can consider Europe all together but it is still a smaller and denser area than the US as a whole. You need to look at places with similar population densities (and perhaps geography) to have an accurate comparison.
I don’t think that’s really “youtubeisms”, I think it’s just the humor he wanted to use, and it’s a genre present across every social media platform. The only YouTubeism to me was the like and subscribe bs.
> The other grift is when people have multiple projects to tell each manager that the workload is high on the other project right now.

Your problems might be a little bit more deeply rooted, WFH abuse sounds like a symptom and not a cause.
Consider a bubble rising to the surface of a pond. As the bubble breaches the surface, it extends beyond the surface and expands as the pressure reduces.

If you consider the surface of the water as a 2D plane, the bubble expands into a third dimension perpendicular to the others. The bubble's surface is made of the same water as the surface of the pond, and there is no hard boundary between them. The bubble pushes part of the 2D plane into the third dimension, which results in the water having more surface area than the total possible area of the 2D plane.

Area (space) has been created without creating matter or energy. The surface is simply extended into an extra spatial dimension.

The way I like to interpret the big bang is as a higher dimensional structure folding or knotting itself such that a bubble is forced into a 3D space. The bubble expands and thus creates more volume than is possible in the lower-dimensional surface the bubble was formed on. This is my ill-informed interpenetration of M-theory.

Dunno why, but much of mathematics and the universe in general makes much more sense to me when viewed in terms of dimensionality. Our universe is 'just' a 4D slice of a higher dimensional structure, and I find a certain kind of beauty in that. In another life, I'd have been a string theorist
See my other reply. It’s not Chaitin’s constant but the mutual information between ZFC and the halting sequence, which is precisely I(ZFC : H) bits.

If you had H, you could optimally compress any non-random string of data of length n in O(n) time. The rough sketch of how you would do this is to create brute-force search programs and then instead of actually running them just look up whether they halt or not via the halting sequence. By chaining together a few of these μ-operator functions, you can build up the whole compressed string 1 bit at a time.

Since we only have a few bits of H, we can’t compress at that level of magic, but what we do have still represents everything computable that ZFC can describe, which for the most part includes every algorithm we use in daily life.