skysight-inc/HackerNews huggingface dataset:
> It's almost like the poor lifestyle choice they made was living in a rural area

It is more that the poor lifestyle choices were already made, so it is most convenient to live in a rural area where there isn't as much social pressure to change. You can easily hide when you live on a desolate backroad. It is hard to hide when stepping outside means immediately running into hundreds of people ready to judge your "undesirable" behaviour.

> population 6,000, tend to live like urban folk

The USA defines urban as a population of at least 2,000 people, so those in that place with 6,000 people don't just live like urban folk. They are urban folk!
antifa? is your name ironic, or you're actually one of the mob?
> Why Starlink does not have such limitations?

Who is to say it doesn't? At least some GPS receivers have those limitations set in firmware, and it's not too difficult to modify the firmware to change those values.

> I find it very hard to argue Starlink is not a military technology!

Sure it is. It's clearly "dual use", at least to some degree.

Not all dual use technologies are export controlled. For that matter, not all strictly military tech is export controlled. The legal/regulatory environment is designed to prevent potential adversaries from bridging the divide between their current capabilities and ours.

I could definitely see it being reasonable to place Starlink in that regulatory bucket, but it isn't necessarily a good idea. While it's convenient for long-distance communications, if there are alternatives that can serve the same use cases with similar investment (cost and complexity) then restricting it wouldn't really help anyone.

> At least its satellites are low, so debris wont stay on orbit forever!

I agree, but don't really see how it's relevant here.
What's the economic incentive for WP Engine to give back? They have a moral duty, sure, but as a business where is the profit? Anything they contribute to core will immediately be available to their competitors, so the naive read is that there's no competitive advantage in contributing back.

However, if they can influence the direction of the project, they can align it with your business goals. That gives them a competitive advantage, that gives them an incentive.

The challenge is that Matt is acting as a BDFL of the open source project. If Matt doesn't want your change added, your change isn't going to get added. There is no one to appeal to, Matt has absolute authority over the code that goes into the open source project that WP Engine's business is built on. Matt is also the CEO of WP Engine's competitor, Automattic.

This conflict of interest has come to a head in the past week and shone a spotlight on the lack of community stewardship of the WordPress project.

Keep in mind that Automattic requires its employees to get approval for any paid side gigs related to software because Matt believes that it creates conflicts of interest. You cannot work on WordPress for Automattic during the day and then freelance making paid WordPress plugins at night, due to the misaligned incentives. The fact that Matt isn't being paid a salary for his work on WordPress is irrelevant, given Automattic's equity is tied to the value of WordPress.

I think private equity skews heavily towards value extraction over value creation. I think that people who build businesses off of open source have a moral obligation to give back to the projects. I think that giving Automattic money to spend on WP core work will make WordPress better.

However, breaking the trust of the community does exponentially more damage to the future of WordPress than any freeloading company. The community trusts that the trademark licenses will not change to target them. The community trusts that their software will benefit from security updates and the plugin ecosystem. That trust is the foundation of WordPress and this week's actions have done damage.

Matt talked about going nuclear, and I think that the metaphor is apt, because when the smoke clears we may be left with no winners.

(I'm a former Automattic employee who roots for open source, WordPress, Automattic, and the vision of the open web Matt Mullenweg has shared.)
Critical Nvidia Container Flaw Exposes Cloud AI Systems to Host Takeover
This went from "hey you guys shouldn't use WP Engine because it's not Real WordPress" to "WP Engine is violating trademarks and isn't welcome in the WordPress community anymore" really f'in quick!
I can already see the motivation posters in a performace-oriented companies: "Be the octopus in your team!"
Use a different part of your brain to combat burnout
OpenSUSE

But it looks like cups-browsed is only needed on the Internet; locally you only need mDNS.
> but that most code bases will require you to earn an architecture astronaut certification for that particular code base.

sure, if go would be popular in enterprise dev, we would see magnitude more error handling spagetti and genericless copy-paste code in go

> But also, the Go spec is a couple of pages

I think you undermeasured it by 20 times. Also it is very possible that golang spec is much more shallow. But anyway, I don't think one need to learn java spec to learn the language.
Is cups meant to be a security boundary?
If you own a car since about 2010 onwards it's probably ratting you out already.

https://www.eff.org/deeplinks/2024/03/how-figure-out-what-yo...
WordPress.org is not "apparently" Automattic
it isnt only about EMPing satellites, it can also be about persistent inhibition of RF propagation with radionucliide chaf, as a deliberate feature.
wow, I suppose this is the quality you get when you fire all the workforce

"it's just code after all"
The trademark infringement claim is interesting. Is there any precedent for a company doing something like "Redis Service" or "Coca Cola Reseller" and getting away with it?
What I was getting at is: legal protections are good and necessary and all, but people try these things presumably because they work sometimes, and that fact bothers me. The idea that current generative AI tech - even if it were actually built to purpose - could actually fight for you in court, or output legal briefs that hold up to scrutiny and don't require review by a human expert, seems laughable to me. Law is definitely not a suitable field for an agent that frequently "hallucinates" and never questions or second-guesses your requests. There's so much that would have to go into such an AI system to be reliable, beyond the actual prose generation, that I certainly wouldn't a priori expect it to exist in 2024.

If so many people are willing to take the claim at face value, that suggests to me a general naivete and lack of understanding of AI out there that really needs to be fixed.

Aside from AI-related stuff, GGP mentioned "monthly subscriptions for services that most people need in a one-off manner". It's amazing to me that anyone would sign up for a monthly subscription to anything at all, without any consideration for whether they'd likely have a use for it every month.
I'm more interested in whether some/all of these work on macOS, which is probably a bigger target.
Likely no good reason. But he seemed to have identified many many systems that were, inexplicably, exposing port 631 to the internet. There is some reason people are doing it and, given the number of target systems, it must be some sort of default configuration.

> "This thing is packaged for anything, in some cases it’s enabled by default, in others it’s not, go figure . Full disclosure, I’ve been scanning the entire public internet IPv4 ranges several times a day for weeks, sending the UDP packet and logging whatever connected back. And I’ve got back connections from hundreds of thousands of devices, with peaks of 200-300K concurrent devices. This file contains a list of the unique Linux systems affected. Note that everything that is not Linux has been filtered out. That is why I was getting increasingly alarmed during the last few weeks."
It's a spooler for a printing system that supports concurrent job submission, potentially among multiple users. It's going to have to achieve serialization some kind of way.
Anything in the last 10 years is probably ratting you out already.

https://www.eff.org/deeplinks/2024/03/how-figure-out-what-yo...
This is up at 17 GHz. It's not the attempt to take over the 900MHz ISM band.
The original CVSS score on Twitter indicated that user interaction was not required. However reading the RCE chain on the page says:

Wait for a print job to be sent to our fake printer for the PPD directives, and therefore the command, to be executed.

If Alice never hits print it seems like a print job will never be triggered. Am I missing something? I'm not questioning evilsocket, I'm trying to check my understanding.
“it depends”. Some considerations for mssql:

- If the foreign server is close (latency) that’s great

- if your query is complex then it helps if the postgres planner can “push down” to mssql. That will usually happen if you aren’t doing joins to local data

I personally like to set up the foreign tables, then materialize the data into a local postgres table using pg_cron. It’s like a basic ETL pipeline completely built into postgres
Elmo's "radical free speech" on full display.
I'd be more on board with this take if it were artists engaging in these lawsuits. Elsevier doesn't elicit the same sympathy, though.

'Stealing' from a company with 2B in profit (much from publicly funded research), LibGen is looking a lot like Robin Hood to Elsevier's Prince John.
>The people who are using libgen, are probably not the people who would pay an author for a book

Isn't that supposed to be the publisher's job? They don't. Just ask the authors.
Bigger AI chatbots more inclined to spew nonsense
The shares will be diluted - the LLC used to be 100% owned by the non-profit; and now there's no bottom.
Likely, but that doesn't mean SpaceX can just ignore his property rights.
It's because of the frankly idiotic idea of persistent print queues. If you want to have this artifact that survives a user session, then the print subsystem needs super-user abilities.

ChromeOS does away with the whole idea. There are no persistent printer queues or jobs. Artifacts of the printing subsystem have lifetime tied to the user session.
On my Ubuntu 22.04 machine, cupsd itself is only listening on localhost, but cups-browsed (which is what has the vulnerability here) is listening on 0.0.0.0
Indeed, SQLite started life as simply a Tcl extension[0] that “escaped into the wild”. Redis was initially prototyped in Tcl too, and ‘antirez has nice things[1] to say about Tcl.

[0] https://sqlite.org/tclsqlite.html

[1] http://antirez.com/articoli/tclmisunderstood.html
It's hardly unique to Kia!

https://www.eff.org/deeplinks/2024/03/how-figure-out-what-yo...
Totally. The fact Microsoft got Three Mile Island to reopen[1] to train AI is unbelievable.

1: https://www.theguardian.com/environment/2024/sep/20/three-mi...
WP Engine is not winning because it’s cheaper. It is a better product than what Automattic offers.

That’s why this action by Matt is ridiculous. WP Engine has grown the overall WP market through good product development and investment. That has produced positive effects for the many companies and people who make their money developing and supporting WP sites for clients.
It is a crazy concept, because taxes are coerced by governments under the threat of violence, whereas the freedoms of FOSS software are intended to be entirely non-coercive. To require compensation of any kind for access and the right to use and distribute code is contrary to the spirit of free and open source software.

If people want to do that, then fair enough, just don't call if free or open source. And don't license your code under free or open source licenses if you care about getting credit or compensation or anything but maximizing software freedom.
I just want to elaborate on something here, the full quote is "yeah so if you ever need info on people just ask; I have over 4000 email, sns, addresses" "What? How'd you manage that one?" "people just submitted it, I don't know why. They 'trust me', dumb fucks"

That's not a great look seeing what they've done since then and people always focus on the wrong part of the quote. "I would've said the same thing" (would you?) - he was offering his friend user info.
+1 for APScheduler, we've been running it in production in multiple apps for going on 4 years now without any issue that I can remember.
>But blocking links to hacked documents regarding JD Vance seems a little suspect considering that, as the article mentions, he was opposed to blocking links to hacked documents about Hunter Biden

Per X, the links were blocked because they included un-redacted personal information such as address and SSN.
Well lots of people crash 600HP cars right after they buy them. If you haven't done your homework, you'll learn quickly.
Occam's razor: I think Sam's personal narrative is the correct one. He built a non-profit that took off in a way that he didn't expect it and now a for-profit is the best way to run the lightning they've caught.

In terms of profit, AFAICT, Sam doesn't have designs on building extra large yachts and his own space agency but what he wants is to be the one at the stead of building what he considers is world-changing tech. One could rationally call this power-hungry but one could also rationally call this just helicopter parenting of a tech you've helped built. And for that a for-profit that is allowed to maximize profits to re-invest in the tech is the optimal setup (esp if all the competitors are doing the same)

Is this a different org than when it started? Yes. Was this a dupe from the beginning? I don't think so.

"But why can't he have a more worldly-aligned board looking over his shoulder?"

Because we live in California and have a bad taste for governance by committee or worse: governance by constant non-representative democracy (see: Housing).

If this now completely comes off the wheels, I still think Congressional action can be a stopgap, but atleast for now, this restructure makes sense to me.
The 9.9 issue is the foomatic-rip vulnerability; not cups-browsed listening on 0.0.0.0. See here:

> LAN: a local attacker can spoof zeroconf / mDNS / DNS-SD advertisements (we will talk more about this in the next writeup) and achieve the same code path leading to RCE.
Can we set the benchmark against the average age of our lawmakers? As they age into a gerontocracy, so too do we age into our midlife crises being 'youthful indiscretions'
> The fact that those boundaries are crossed means that anyone who is in competition with Automattic might have any and all ecosystems that Matt has any control over leveraged against them if they upset Matt or Automattic in any way.

There was never a boundary in the first place if it's the same guy doing both things. WordPress has always had this veneer of "community-driven", which is what they hide behind when people get their sites exploited, but Automattic really holds all the keys here. Just because Matt replies with an `@wordpress.org` email vs. an `@wordpress.com` email doesn't mean he's a different person all of a sudden.
What a fascinating dataset they've constructed. Is the network available for download somewhere? I didn't see anything obvious.
I used it a few times, mainly because of Freewrap. With very little code I was able to write a Windows app with GUI that I could distribute easily as an executable:

- A backup app for an online sales application (inputs items and spits out a file);
- An app to fix files in a buggy POS for a large retail chain (this might have been used in thousands of machines, I can't recall the details now);
- A small app to copy Forms/Reports to the server, fire compilation, and push the new file to git;
- A wrapper for gs to help a media department easily join many PDFs into one file.

All these have a page or maybe two of code.
If you're referring to US law, Twitter was never a telecommunications common carrier. So it can't lose that status through any sort of moderation decisions.
One thing to consider about veal is that it's an unavoidable byproduct of the dairy industry. Veal calves do not need to be mistreated to become veal, but the plain fact is that they are also not going to be kept alive either. A male cattle that is not a breeding bull has no economic value until its corpse is processed, barring entertainment uses like rodeo.

If you refuse to eat even humane veal (free to roam and milk-fed), then IMO you should refuse dairy entirely.

It might also be worth considering that the entire concept of humane dairy is questionable. It depends on separating mothers from calves, and either eating the latter or weaning them at far too young an age, or both. Cows are dumb, but they're not that dumb, and more importantly they are prey mammals with strong "familial" instincts. The process is fundamentally at least somewhat cruel.
Imagine being an original Twitter employee that's still stuck around. You could ask for a 7-figure salary, and your toughest job would be implementing a regex filter for the JD Vance leak.
I wonder how well current adaptive cruise control/collision prevention technology works to help someone safely drive drunk. I don't own a car with these features but once rented a 2021 Nissan for a road trip and just set the cruise control to 70 and it would maintain a safe distance from other cars automatically down to like 20 mph iirc. I didn't, but I probably could have been drunk and driven that car without much issue, not that I am advocating for this.

There's probably already a bunch of data being collected about cars parked at e.g. a bar for a few hours that's being used to train some AI to detect driving behaviors associated with drunk driving or something like that.
I literally live here. The drop in quality of public services is throughly unjustified.

A madman who believes firefighting services should be privatized and who has not shown the least concern about the fact that these policies are measurably increasing food insecurity among children has no place governing.
https://youtu.be/1sbZLhuaZIY

Duck Sauce - Barbara Streisand

(It's just a really catchy song. And I suspect this block will backfire.)
Keep in mind that you still need send a print job to the fake printer to trigger the exploit. If you send the job to your real printer, nothing happens.
Twitter banned me after publishing the JD Vance Dossier
This is quite common in Europe. There is normally no special relationship with the original dealer and the service history is centralised for most manufacturers.
if we’re going by the trademark policy, it also says you can’t use the wordpress name in the name of your project or service.

and arguing that “wp” doesn’t mean “wordpress” and therefore is allowed, is exactly the same as me selling “msengine” for microsoft products, and telling everyone “ms” doesn’t mean microsoft. we all know what it stands for for, and if you weren’t sure, you can jut scan the page and see it’s clearly associated with wordpress. if that’s the basis of the legal defense wpengine wants to make in court, they are truly f’d.
Now Twitter has both left and right propaganda instead of just left wing propaganda. Bummer.
A lot of pen testing companies are glorified but box checkers.

I’ve submitted many applications with glaring security holes in them to pen testing and never heard a peep.
Why does it even listens in UDP at this day and age?!
In that sense, yes, very little magic...enabling vast conjurations. :-)
Glad my VW only had a 3G antenna built in. No longer works in the US.
Do you really believe that? Stuff like that is really troublesome to keep alive. Piratebay is hardly the thing is was, and it's a torrent site, which is relatively easy to host. A better example would be rarbg, which is not alive anymore. They only exist because of almost fanatical dedication of some highly productive individuals, god bless them. Even if they don't get into serious trouble, it's still a hassle to avoid getting into trouble and work with actual content, not just host a bunch of torrent-links other people provide. So, at some point they'll lose the desire to do that, and I am not so sure that there always will be somebody to take post.

In fact, I even worry a bit about what will happen to Linux when Torvalds finally passes away, and for sure Linux depends on him much less so than all those pirate resources on the people who maintain them.
Idk if I’d call my setup minimalist, but I write blog posts in org, and use ox-Hugo to export them to hugo.

I like hugo.

Good tempting language and taxonomy features.
China's 'Silver Economy' Is Thriving as Birthrate Plunges
Depending on your interpretation of the Scope metric in CVSSv3, this is either an 8.8 or a 9.6 CVSS to be more accurate.

In summary, there's a service (CUPS) that is exposed to the LAN (0.0.0.0) on at least some desktop flavors of Linux and runs as root that is vulnerable to unauth RCE. CUPS is not a default service on most of the server-oriented linux machines like Ubuntu Server or CentOS, but does appear to start by default on most desktop flavors of linux. To trigger the RCE the user on the vulnerable linux machine must print a document after being exploited.

Evilsocket claims to have had 100's of thousands of callbacks showing that despite the fact most of us have probably never printed anything from Linux, the impact is enough to create a large botnet regardless.
What if the internet is used for that?
This is nowhere near as severe as the Heartbleed bug.
The only reason to use it today is because you're forced to by the EDA industry. Otherwise there are far far better options.

That also means this release is basically irrelevant for the next 10 years because that's about how long it takes the EDA vendors to update their bundled TCL versions.
Github has given it a 4.4 score: https://github.com/OpenPrinting/cups/security/advisories/GHS...
From the last image in the article:

> 3. Command execution (cups-browsed, cups-filters): 9.9

> CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L - CWE-94
I'm mostly unhappy with the current usage of LLMs. Not sure if I qualify as a "never-AI guy".

My main pet peeve is that AI is a blurry term almost to the point it has no definitions. It's basically a marketing term. AI has been applied, historically, to many trendy and novel facets of computer science, until they are not novel anymore and then they stop being AI. Expert systems, voice generation, image processing, genetic algorithms...

My take on the article: this is cool. I don't think I would call it AI though, if I could avoid it.