skysight-inc/HackerNews huggingface dataset:
I remember there was some like viral marketing thing some company did a while back where they had a website where they had a webcam pointed at a printer, and anything printed would go on a conveyer belt and fall into a literal dumpster fire. Users could submit stuff on their website and see it printed and burned live.

...anyways, maybe they were vulnerable to this attack at the time?
It's almost like the poor lifestyle choice they made was living in a rural area and not keeping a garden.

My perspective may be skewed by my relatives who live in rural Appalachia. They keep gardens, have physical jobs, and hunt for meat. They live a few miles outside of a small town whose hospital just closed - the only one in the county. They do have a proper emergency care center that's designed to be able to get you stabilized and then transfer you to a hospital outside of the county.

You're right though - the people that live "in town", population 6,000, tend to live like urban folk without the urban amenities like you mentioned. I have no idea why people choose to live like that.
Sure, but how do you even keep it sustainable? All most useful things in the world are kinda fundamentally non-monetizable, illegal, or both. Wikipedia is the only thing that succeeded, and even that I'm starting to have some doubts about, because of how heavily politically influenced it is.
I assume it's the one linked on your profile. I'll check it out!
Possibly because the devs reduced the numbers he says: "because the devs just can't accept that their code is crap - responsible disclosure: no more"

Always kind of worrying to see vulnerability researchers justifying bad behaviour because they find a vulnerability in code. Maybe it was because his pride was hurt that he threw away any ethical behaviour?
> I would be surprised if OpenAI was a whole digit percentage of their revenue.

It is not publicly known how much revenue Nvidia gets from OpenAI, but it is likely more than 1%, and they may be one of the top 4 unnamed customers in their 10Q filing, which would mean at least 10% and $3 billion [0].

That's not nothing.

[0] https://www.yahoo.com/tech/nvidia-gets-almost-half-revenue-0...
> But the bigger lesson is bitterer. Frontend tooling isnt worth that much.

This is a modern oddity, as historically front end tooling was worth a lot.

During the 80s and 90s, multiple companies made a lot of money off of front end tooling. Even as late as 2009 or so, Silverlight tooling was bringing in money for Microsoft. But think of how popular Flash was and the empire that helped build. Prior to that. Visual Basic helped Microsoft take over the world. Go back another generation and Borland's Delphi dominated for years.

And, arguably, all of those systems were more productive than anything we have now. (A topic I've written about many times!) As an industry, we may indeed be getting exactly what we pay for.
I don't know if I would say it's a nothing burger, but i don't see how it affects important servers. It might impact a number of linux desktops and, if they are linked to important servers, provide a backdoor access into important services.

Being able to run arbitrary code in a root account with no authentication would seem to be a pretty important security breach, although I don't think it's quite the level of danger it was built up to be.
> I want to push back on the "async rust bad/failure/not ready" meme because

Absolutely; to be clear, I think async Rust has been a massive success, and has a lot of painfully rough edges. The rough edges don't invalidate the massive success, and the massive success doesn't invalidate the painfully rough edges.
How is it anti-competitive to stop people smashing your APIs? That shit costs money man. It's not free to provide web resources to hundreds of thousands of people.

WPE is essentially DDOSing WP for free. Obviously that shit doesn't fly. Either pay up or get your own server and host your own shit.
Reminds me of the expression "in and of itself".
I should also note that Richard Hipp, the creator of SQLite, says that SQLite is coded in Tcl. The database engine itself is coded in C, of course; but the vastly larger test suite is mostly coded in Tcl; and it's the test suite that makes SQLite the reliable engine that it is. The test suite persists; the engine's been re-written in whole and in part.
I feel like printers are far better now than they were 10 years ago. At least on MacOS and iOS, I have no problems finding a printer and printing. 10 years ago it was a pain, but now - smooth sailing for me. Heck, no driver installs either!
Funny how the whole FSF movement started in no small part because Stallman was irritated with the low quality of printer drivers... and how that movement for some (?) reason failed, in 40 years, to noticeably improve the quality of printer-related software.
Yeah, I saw this yesterday and while most of these look legitimate, some of them are a real stretch.

It does make me wonder if these models suffer from pareidolia. If so, does that say anything about how similar they are to human intelligence? Or are they basically "inheriting" humanity's evolutionary biases as a function of their having been trained on human-generated content?
This is very cool. I was randomly clicking on circles and thinking it was weird that none of them sounded bad yet. Then I clicked on one of the presets, which merged its state in, and realized it was indeed possible to end up with a loop that just sounds bad!
it's not because you don't use it that a lots of others aren't, it's pretty lively there whereas google wave never really saw any traction
And, for some utterly and completely absurd reason, CUPS runs as a system daemon instead of a highly sandboxed user program.
Well, I'm not sure there'd be much benefit to spending energy on a 3rd eye. You can already achieve stereoscopic vision with just two eyes, why waste the energy on a third? It probably doesn't increase fitness enough to be worth the energy spend.
That's my bet too, but I'm not confident enough to say that I could "know" that.
Tcl is incredibly consistent, because it's homoiconic.
I suppose the real question now is: did the author give it a 9.9 out of ignorance or malice/ego?
There's a difference between a naysayer and criticism. Using your iPod example, it was described as lame, in a way to dismiss it out of hand. But it did indeed have less space than a Nomad. That's valid, but ultimately unimportant, criticism.

People here are criticizing the business fundamentals of the openAI company. What are your takes on its finances? Or are you just on board, everything is great, do not look behind the curtain where we hide our five billion dollar losses?
Which distro do you see Cups listening on 0.0.0.0?
On Debian (at least, only one I have handy) it only listens on localhost.

[edit: I was wrong, it listens on 0.0.0.0 for UDP. I was only checking TCP. ]
I though this was going to be NetworkManager the way they were hyping it up.
> The resources of Wordpress.org and the Wordpress Foundation should not be leverage in this dispute.

I honestly wonder if it crosses any legal boundaries. From what I can tell, it's essentially the non-profit acting on commands from the for-profit.

Basically the equivalent in my mind to a "in-kind donation".
>Sony contributes back. To FreeBSD even, they are even listed in their list of contributors.

I just used Sony as an example to tinker what is the definition of contributing enough that Matt Mullenweg was talking about:https://wordpress.org/news/2024/09/wp-engine/#:~:text=(To%20....)

I don't have anything against Sony.
I'm pretty sure all major distros configure it to listen locally instead.
Nice summary! Any guides you’d suggest for someone new to all of this, in terms of getting a simple blog set up with Astro?
Karpathy stands to gain enormous wealth and prestige of he's right so he's obviously biased.
Are you being sarcastic?

https://www.reuters.com/technology/metas-threads-hits-over-1....

> Meta's Threads hits 175 million users ahead of one-year anniversary
Perhaps, but those people are the bug in this hypothetical. They should instead delegate decisions to someone who is competent. Obviously the real world is filled with bugs of this nature, but helpful to at least recognize where the problem stems from.
Meanwhile a national border separates the towns of Chamonix and Courmayeur (distance, about 4 miles), and not only do you not have to deal with border issues, and you don't have to summit the tremendous mountain range in between, they dug a direct tunnel and built cable-cars!
in supabase we have a “vault” utility for this (for example: https://fdw.dev/catalog/clickhouse/#connecting-to-clickhouse). Sorry I can’t make recommendations for other platforms because i don’t want to suggest anything that could be considered unsafe - hopefully others can chime in
Things will eat me, if I let them.
printing even works on linux now, thanks to stuff like Airprint and the support for it in CUPS
Oh yeah — I definitely understand that some people need ADHD meds to function normally: my partner is one of them, too. We joke during acute shortages that it must be exam season at the local colleges. But of course I know there are chronic shortage issues as well that aren’t simply explained by students wanting a quick boost. I’m mostly poking at people that don’t need it using it to augment their focus.

One thing that I wasn’t aware of until I happened upon a blurb somewhere is that Adderall is harder to get in many other countries than in the US (and seemingly impossible/illegal in a few).
Once they decided to block showing new posts for tags, leaving only the so-called "top posts", I stopped using Instagram as it stopped making any sense to me, i.e. I could no longer find anything interesting.
Most schools can't afford this
> Doesn't the US privatized

Isn't that less than 10% of the market (i.e. most prisons are not private)
The names and backgrounds of all of the people maintaining Tor are easily found.
Funny how their definition of changing the world amounts to: Fuck you, got mine.
This looks more like they had a bug and lost a few, other than a static photo representation that was probably stored independently.
Shahed drones are so slow that the civilian GPS receiver limits wouldn't affect them either. GPS is limited to receivers moving slower than 510 meters per second and below 18 km altitude: https://en.wikipedia.org/wiki/Coordinating_Committee_for_Mul...

The Shahed-136 flies at low altitude and around 185 km/hour, well below the 1836 km/hour speed CoCom limit on GPS: https://en.wikipedia.org/wiki/HESA_Shahed_136
Wait, this is a joke, right?

> A remote unauthenticated attacker can silently replace existing printers’ (or install new ones) IPP urls with a malicious one, resulting in arbitrary command execution (on the computer) *when a print job is started (from that computer).*

(emphasis mine)

There's no way this is 9.9 when Heartbleed was just 7.5...

EDIT: Wanted to add why I think he has overblown this way too much. His original tweet stated "* Unauthenticated RCE vs all GNU/Linux systems (plus others)" but as we can see this isn't nearly the case as on a lot of distros CUPS only listens on loopback or isn't installed at all.

Another point:

> Full disclosure, I’ve been scanning the entire public internet IPv4 ranges several times a day for weeks, sending the UDP packet and logging whatever connected back. And I’ve got back connections from hundreds of thousands of devices, with peaks of 200-300K concurrent devices

If I'm understanding this correctly, he only found 300 thousand open CUPS instances in the whole public IPv4. Remember - the CUPS server needs to receive a print job in order for the RCE to happen, which I doubt most of these instances will get.
But why would such desktops be exposed to the public internet directly?
> Is there a minimal amount of magic? No; the amount of magic you can do is effectively unlimited.

I might be mistaken, but I think the OP was asking if there is surprising magic (I.e. special cases/considerations) built into the language, in which case I’d say, “No, Tcl is not “magical”, but surprisingly simple and regular.” That said, indeed it’s powerful in its application of its primitives, but you do still need to mind some things (don’t pretend* you can quote better than the quoting engine, don’t pretend* you can do lists better than the list processor, …). Not magical though - very understandable.

*rules are meant to be broken, blah, blah, but the “gotchas” are new practitioners falling into this, or advanced cases, falling into this…
let me ELI5:

* I pressed my finger

* nothing happened

* it feels broken

the reason is that it is camera based, unlike Orion. And this is why people describe Orion as magical, whereas nobody talks about the hand gestures of the Apple Vision Pro (but people do talk about the eye tracking of the AVP as magical)
OpenAI’s GPT-3 model (175B) has an archive size of about 350 GB, with training data estimated in the hundreds of terabytes, resulting in a highly compressed ratio.
A basic firewall configuration could easily prevent this even if you are running the vulnerable version
The WordPress trademark guides say explicitly that "WP" is allowed to be used by others. Several other parts of the wording the WP Engine uses are also explicitly allowed. So your whole first two paragraphs are mistaken.
RedHat did, as per the article
on popOS I see 0.0.0.0:*

I'm not sure why it deviates from Debian and Ubuntu which its based on though
I certainly appreciate your efforts, and the efforts of everyone involved. I know a few authors and copy editors, and it seems like an incredible amount of work to deliver the finished product.

I suppose my snark was more in reference to the textbook market, which seems to be the primary focus of Libgen. Academic textbooks seem primarily to be a way to extract some student loan money into publishers' pockets, with plenty of obvious typos, problems that can't be completed, and new editions every year that simply change the order of chapters without fixing any of those issues.

When I was a student, in several of my technical classes, after every test we'd spend a class correcting the answers provided by the textbook that disagreed with more authoritative sources. Spending $100 for a book that was only half right when I could have bought a real technical book for $40 has made me cynical about the whole industry.
Ask HN: Digital Footprint
Have you ever considered your digital footprint?

I sometimes find myself wondering how long my Git commits will serve as a marker of my presence.
I guess the important question is whether or not these things are blocked by default or require user intervention to disable cups? Sure, many of us block all ports by default and either route everything behind a reverse proxy or punch very specific holes in the firewall that we know are there and can monitor, but someone firing up an ubuntu distribution for their first foray into linux is probably not thinking that way.
Unconditional basic income. Grants for the arts. Stipends. Unconditional basic income. Sponsorships. Unconditional basic income. Donations. Maybe even unconditional basic income.

Look, no artistic endeavor needs to make a billion dollars. Even when something does take a billion dollars in revenue, none of it goes to the artists anyway! Music labels and movie studios and book publishers are infamous for creative accounting and bogus contracts and outright lies to fuck over almost every person that actually contributed to the art. They're worse than politicians. It's all there to funnel even more money to people who are already rich. If you put artists on basic income you're not paying them any less, you're not losing anything, 99.9% of them come out ahead of where they would've been if they'd sold their work for money. Maybe add a couple more nines to that list. For every multimillionaire movie star or generation-defining author there are literally hundreds of thousands of artists just barely scraping by. Capitalist art only benefits the leeches.
I guess you get the natural haptic, but the feedback is visual/audio (happens in software). In any case the link between haptic and visual/audio action is kinda broken on the vision pro
Queue everyone going to Shodan and investigating how many systems have port 631 on UDP open..
Geez, yeah, that notice reads like they lost some data. And didn't tell anyone about it, unless you looked. And in July 2025 they'll memory-hole the "Sorry^W, we lost your data." notice.

Edit: Correction, there's no "Sorry".
Thanks for the pointers. The diff is tiny and deals only with resuming downloads. i.e: everything else is left as is.
There was a research regarding implicit persistence OSes, see KeyKOS (https://web.archive.org/web/20030426221706/http://www.cis.up...) and EROS (https://web.archive.org/web/20030430223846/http://www.eros-o...).
> I'm curious to know if "newly discovered" species existed 20 years ago and were actually just discovered,

That's exactly it, these wasps existed previously and were just discovered to be distinct from other wasps. Speciation tends to take a very long time (on the order of hundreds of thousands to millions of years) or much shorter if there's a strong enough pressure (e.g. something drastically alters an ecosystem and opens up a lot of new niches for a species to radiate into) but still on the order of tens of thousands of years, see [1] for a great example. This of course depends on generation time (evolution only happens to populations, not individuals), so we see quite rapid evolution in things with short generation times like bacteria.

For invetebrates like small wasps like this one, it's typically taking the time to sit down and actually identifying them, some species are quite cryptic and it's only obscure or small morphological features that can be used to separate them by eye, and requires genetic analysis to compare and confirm that it's a new species.

> Examining old hosts that have died and been preserved and seeing if the 'new species' exists there maybe?

I have an entomologist friend and yes, that does happen. There are probably countless new species that have specimens in museums and universities right now that just haven't been properly analysed

1: https://www.scientificamerican.com/article/the-extraordinary...
It's always funny to me how cybersecurity always seem to attract people with a ... certain sense of ego.
It's also absurdly easy to integrate into C or C++ projects, or to write an extension in C or C++ which can be loaded to implement new commands.
Before ebooks came abundant the publishers said some 10% of book price is their money, another 10-15% is for author and editors, and the rest is eaten up by print and distribution+shop. I guess the distribution through publishers' site can be done at 20% of sales price.
Thx :). I thought the 3 looked like a b but didn't think brd would make any sense. My reasoning has led me astray.
Yep. I’ve forgotten or lost keys in the past and been locked out, but never have all of my e-locks and garage died at once.
great comment, I don't get it
I dunno your age or background, but FWIW I feel like his shtick made a lot more sense in the context of early 90s Canadian media.

The zeitgeist was unpretentious, goofy, "slack", earnest-but-also-ironically-detached. So Gen X, but also MuchMusic in 1993 was a lot more like MTV in 1983, except as run by terminally uncool Midwesterners - it almost had the low-budget energy of public access. Weird Al (who has a similar shtick, now that I think about it) would take over the channel over the holidays, and they had an annual New Years tradition where they'd chuck a Christmas tree off the roof of their studio. One of their hosts was a foul-mouthed sock puppet. Growing up in Toronto, for a time it felt an awful lot like the biggest song in the world was "If I Had $1000000" by the Barenaked Ladies.

Nardwuar fit right in, in that media environment - not to say he wasn't sui generis, even then! But I can understand that, divorced of that context, he might just seem like a weirdo.
A $100k device without warranty? I don’t think the battery pictured in the article is the actual one, with 1.7Wh there’s not much walking to have, if it is that battery is like $3 on aliexpress.
Wow, good job Elon. I've downloaded the dossier and I'm telling my friends. Send Barbara Streisand my regards!
You're off the scent, but I wish you well
I often use the tool that is closest to another tool I am using. The closeness may be due to a common heritage, both technical and cultural. A common thread between the two is often high quality, maturity, cross-fertilization, long-term commitment, etc.

Now when it comes to Tcl, I use it for the above reasons because it is so convenient for writing scripts to use SQLite. In other words, it is my go-to wrapper for many SQLite applications. This is mainly related to (rapid) prototyping use cases.

From https://sqlite.org/tclsqlite.html :

> The SQLite library is designed to be very easy to use from a Tcl or Tcl/Tk script. SQLite began as a Tcl extension and the primary test suite for SQLite is written in TCL. SQLite can be used with any programming language, but its connections to TCL run deep.
The getting started docs[1] are really good, I’d recommend starting there for sure.

Basically you just run a few commands and you’ve got a website. Edit the Astro files to put HTML in, don’t worry about any JavaScript.

Then try adding a simple “site header” component and using that.

1. https://docs.astro.build/en/tutorial/1-setup/2/
Ten nasty software bugs put fuel storage tanks risk of cyberattacks
I wonder how much does Automattic contribute to the PHP, MySQL, MariaDB, jQuery, ... organizations?
>I'm not sure they mean "LLM based AI"

The article states that they use ChatGPT.
The block is very amateurishly implemented, and can be circumvented by appending any query param to the URL, like so: https://www.kenklippenstein.com/p/read-the-jd-vance-dossier?...

Update: I guess someone at Twitter reads Hacker News, because they finally forced me to delete the posts containing those links, a few hours later.
IPFS Companion
Oh my god, you cracked it. After all these years..
We kill millions of humans with agency every day on this planet. And none of them immediately die if we stop providing them with electrical power ... well I guess a small amount of them do. Anyway, we'll be fine. If the AI come, can they immediately stop us from growing food? How can an AI prevent my orchard from giving apples next year? Sure, it can mess up Facebook, but at this point that'd be a benefit.
Do networked printers themselves run CUPS? E.g. a Brother or HP laserjet plugged into a LAN.
I wish there was a repository with lots of posts like this one. Super useful to learn from!
This is the worry. It seems like a really unnecessary privilege escalation.
At a certain point, if Musk consistently blocks things favoring one party and not another does X risk losing its Common Carrier status and start opening itself up to more liability?
Universities are not just businesses, but an investment in future generations
Trump is notorious for not paying his lawyers, so as representation goes, he’s left with a bag of mixed nuts to say the least.
I am slightly confused. If I am using a linux laptop with cups do I need to do anything besides update? Is there a sane way to print from the linux desktop. I unfortunately need to regularly print, and often from public wifi.
I think this should be merged into/marked a dupe of https://news.ycombinator.com/item?id=41662596
Authors? Its the publishers who get paid. The authors just write the words.
That's the wrong column of netstat output, I think. "0.0.0.0:*" stands in for the (non-existent) peer address of a listening port.
Remote Code Execution, DoS Vulnerabilities Patched in OpenPLC