skysight-inc/HackerNews huggingface dataset:
Phishing Fake ESports League Voting Scam
Introduction

On October 22, 2024, I received a suspicious link asking me to vote for a player in a fictional ESports league. The link, https://flpladder.pro/cup/vote/, initially appeared to be a legitimate voting platform, but upon further investigation, it was discovered to be a phishing scam.

Initial Investigation

Upon visiting the link, I noticed that the website was not very responsive, but it seemed to be a legitimate E-Sports league voting platform. However, I decided to investigate further by examining the source code of the website.

Discovery of Hidden Website

While combing through the source code, I discovered a hidden website located at https://sss.flpladderauth.pro/2d22de0d9. This website was poorly designed and appeared to be an amateur attempt at creating a legitimate website.

Discovery of Malicious JavaScript File

Further investigation led me to a JavaScript file located at https://flpladder.pro/cup/midway/app/js/main.js. Upon analyzing this file, I discovered a hidden iframe that was designed to phish user credentials.

Phishing Scam Details

The phishing scam appears to be targeting Steam users, as the hidden iframe is designed to mimic a Steam Community login page. The scam is likely intended to trick users into entering their Steam login credentials, which could be used for malicious purposes.

Assets Used to Create Legitimate Steam Page

The phishing website used the following assets to create a legitimate-looking Steam page:

A fake Steam Community logo
A URL bar that mimics the Steam Community URL format
A password input field that is designed to look like the Steam Community login page
A "Connection is secure" message that is designed to look like the Steam Community security message
A "Site settings" dropdown menu that is designed to look like the Steam Community site settings menu
A "Cookies" message that is designed to look like the Steam Community cookies message
Web Host Information

The web host of the phishing website is Endurance International Group, a company based in Burlington, MA. I recommend reporting the phishing website to their abuse department to request that the website be taken down.

Recommendations

Report the phishing website to Endurance International Group's abuse department
Report the phishing website to Google's Safe Browsing team
Report the phishing website to Steam's support team
Warn others about the phishing scam to prevent further victimization
Evidence

Screenshots of the phishing website and hidden iframe
Source code of the phishing website and JavaScript file
URLs of the phishing website and hidden iframe
Recommendations for Future Prevention

Be cautious when receiving unsolicited links or emails asking for personal information
Verify the legitimacy of websites and organizations before providing sensitive information
Use strong, unique passwords and enable two-factor authentication whenever possible
Keep software and operating systems up to date with the latest security patches
Abuse Report Information
If we do face a wave of disaster, it will be because the government has prevented sufficient building of powerplants.
yeahh this was my first thought. i miss del.icio.us, the tagging was so good and helped me keep things organized and discover high quality content
>At some point fewer and fewer Americans will be able to afford the things corporations sell. If you are a predator and you kill off your prey, you will die.

I some times wish that were actually the case. Revolutions don't happen until people can't afford bread. So they're drip feeding us just enough to keep things on that edge. In a lot of ways life is cheaper and easier now for consumers overall. Everyone can afford a big screen TV, smartphone, etc. Consumer goods are kept at that level. But assets have simultaeneously reached levels that are completely unattainable for 90% of people. They want to keep us in this "constant now" where there are no thoughts of retirement or wealth or ownership of anything. Just a nonstop struggle to keep the lights on in a way that's just bareable enough to not rock the boat.
Since many states don't allow registration on the same day as voting, I'd say the government has planned accordingly after passing the aforementioned voter ID laws. Just found out this is a a standard federally: https://news.ycombinator.com/item?id=41921184
>In your coffee shop-like scenario, what benefit does a captive portal on anonymous Wifi offer to either the customer or the coffee shop, over regular Wifi authentication, and a sign on the wall that says "wifi username/passowrd is..."

From an access control perspective, it probably doesn't matter much for a coffee shop, but matters more for something for a hotel where you want to limit to certain guests only (eg. ones with room or loyalty program members)

From a legal perspective, having an interstitial might provide cover for when a baddie uses the connection to order drugs or whatever. IANAL and I'm not sure whether it's actually needed or not, but most companies rather not risk it. Moreover it's unlikely that no jurisdictions require it, so you'd still support for it.

>As for importing a private CA. Use a certificate trusted by a public CA and you won't have this problem?

No idea. Last time I had to use WPA enterprise, the organization providing the connection isn't exactly small and couldn't afford a certificate, but still required me to import a CA. That makes me think it might be an inherent issue with WPA enterprise.
What kind of code? what domains?
No, but they chose Australia over the other surrounding countries for geopolitical reasons (related to the above two points I mentioned) best not mentioned in polite company.
Comments moved to https://news.ycombinator.com/item?id=41900190.
> In every math course there is massive amounts of cheating on everything that is graded that is not proctored in a classroom setting. Locking down browsers and whatnot does not prevent cheating

This is kind of astonishing to me, because for most of my math and engineering courses cheating on take home work would not have improved my final grade (much less helped me learn the material, which is kind of the point I thought, and often necessary for subsequent courses.)

It seems common for math (and related) courses to grade almost entirely based on in-person, in-class exams. In some courses problem sets are optional (though they can be turned in for evaluation) but are recommended for understanding and practice.

Exams can go poorly, so perhaps having more of them (e.g. frequent quizzes) can help to compensate for having a bad day. Also exams can include basic problems, ones that are very similar to problem sets or worked problems from lectures, etc.

> If we did truly devise a system that prevents cheating we’ll see that a very high percentage of current college students are not ready to be truly college educated.

That sounds like an improvement over the current situation?
You don't need to make up a state of mind for other people - the smart approach is to realize you have no idea what they are thinking - just politely say what you have to say. The second paragraph is fine.

I don't see where it's expressed above (?); no willfullness involved - I didn't even realize that you thought were having such a heated discussion. The other commenter also didn't pick up on it either.
AWS Cloud Quest – Develop cloud skills in this immersive role-playing simulation
This is because it will be absolutely catastrophic economically when the majority of high paying jobs can be automated and owned by a few billionaires. Then what will go along with this catastrophe will be all the service people who had jobs to support the people with high paid jobs, they're fucked too. People don't want to have to face that.

We'd be losing access to food, shelter, insurance, purpose. I can't blame people for at least telling themselves some coping story.

It's going to be absolutely ruinous for many people. So what else should they do, admit they're fucked? I know we like to always be cold rational engineers on this forum, but shit looks pretty bleak in the short term if this goal of automating everyone's work comes true and there are basically zero social safety nets to deal with it.

I live abroad and my visa is tied to my job, so not only would losing my job be ruinous financially, it will likely mean deportation too as there will be no other job for me to turn to for renewal.
It's a distinction with no difference. Only massless particles can move at the "maximum speed", in our Universe these are photons and gluons. And maybe gravitons, if they exist.

Similarly, massless particles can't move below the "maximum speed", as they'll have no energy or momentum and won't be able to interact with anything.
They need to work on their versioning.

"3.5 Sonnet (New)", WTAF? - just call it 3.6 Sonnet or something.

Is it "New" sonnet? is it "upgraded"? Is there a difference? How do I know which one I use?

I can understand claude-3-5-sonnet-20241022, but that's not what users see.
Here's some function list usage: for V0 here, branching on each potential character is inefficient; so an option is to do an array index-of among the characters, and pick out the respective function from a function list: https://dzaima.github.io/paste/#0dZLPSgJRFMb38xQXNyajNRPUwqy... (and, for a duration of 1 glyph, there's even a matrix containing functions there!)
> [...] now he sends me a text message a few times a month for a coffee

Maybe he's bored all the rest of the time in the month when they're not having coffee together (the other 95%+ of the month)
Yes, indeed, slavery (which is effectively what minimum wage work is) makes things cheaper.

Not sure that's sustainable though.
Cheerleading Became So Acrobatic, Dangerous and Popular
You didn't actually argue against the point though. How is it obvious that raising the minimum wage benefits all Americans? The people making wage already don't "have any money" yet the economy is fine anyways since they don't make up the majority of spending. Debt has been high forever.

Marx is right, the only thing that matters is labor + capex to create products / services. If rich people want to move money around buying expensive crap that's marginally better and isn't too much harder to produce, we should encourage that. As of now, most of the S&P 500 focuses on producing products for the common man or other businesses. This is exactly what you'd want to see and I don't see why we should rock the boat and reduce the total labor spent on the needs of the average person (minimum wage labor).
> Qualcomm develops a chip that competitive in performance to ARM

That’s what Oryon is, in theory.
I don't want to get too far afield here, but just in the interest of the parent point about assuming good faith, please take a look at this article if you have time:
https://www.theatlantic.com/politics/archive/2023/05/dr-warr...

"Up until around 32 weeks," and not all with medical diagnoses. And this is under current law. Can you say that everyone should be completely comfortable with this?
Migration of the build system to autosetup
OP here!

Richard Hipp, of sqlite fame, has announced that the sqlite project plans to reimplement its canonical build process in the 3.48 release cycle. The project will, if all goes as planned, be moving away from the GNU Autotools and towards Steve Bennett's Autosetup, which we've used to good effect since 2011 in SQLite's sibling project, the Fossil SCM.

The primary motivation behind this HN post is to draw eyes to what Richard points out in the linked forum post: this port _will_ break some folks' build processes and we'd like to know, in advance, what we'll be breaking so that we can make that transition as painless as we can. If you do "unusual" things with the SQLite build, please let us know about it (preferably in the linked-to forum, as that's less likely to be overlooked than comments on HN are, but we'll be following this thread for at least a few days for those of you who would prefer to voice your thoughts here).
Great! So then when they change it to allow for the issuing of voter IDs on election day, it can be done at the federal level in one fell swoop. And who knows, maybe this voter ID can be a national one so no need to deal with state bureaucracies.
The readme of repository includes a paragraph suggesting that companies should reach out for a commercial license. For an MIT licensed codebase that is unusual. I believe the top-level commenter is assuming that discrepancy is by mistake and is giving a heads up.

From the readme:

>Note: Companies interested in purchasing a license to use the source code commercially can contact this number on WhatsApp
This is malware, plain and simple. It's not ambiguous.
It would be naive to think that Qualcomm is only starting its RISC-V effort today and from scratch.
Am I the only one who finds Python's "forwards" backtraces confusing compared to every other language I've used? I can't help but think at least part of this confusion is because of that.

That said:

* Would printing the trace as a tree actually clarify anything?

* Good code almost always minimizes the amount of code in an exception handler.

* `raise_exception()` is generally bad practice; consider `raise get_exception()` if you need something complicated (among others, this allows choice of `from`)

* `raise ... from None` is useful since it's often the most recent stacktrace that's actually relevant.

* `raise ... from e` likely implies that it is the older stacktrace that's most relevant; ideally this would just be a single annotation on a particular frame "exception was replaced here".
Most major apps use the NDK.
> Legal cover for when a baddie uses the connection to order drugs or whatever.

.... Is this meant to be a joke?

> still required me to import a CA

It's reasonably likely that they wanted it to only work on known devices with their private CA cert installed; but either way, and regardless of the technology in question, I wouldn't suggest it's particularly meaningful to use one organisation's setup as the basis for how things inherently work.
For Apple it was do or die the first few times. Until x86, if they didn’t move they’d just be left in the dust and their market would disappear.

The ARM transition wasn’t strictly necessary like the last ones. It had huge benefits for them, so it makes sense, but they also knew what they were doing by then.

In your examples (which are great) Intel wasn’t going to die. They had backups, and many of those seem guided more by business goals than a do-or-die situation.

I wonder if that’s part of why they failed.
That remains to be seen. Studies purporting to show the harms of social media are shaky at best. It could very well turn out to be more benign like TVs or violent video games (remember the pearl clutching around those in the early 2000s?).
NDK exists.
The Economic Limits of Cryptocurrencies and Blockchains
The easiest way to jump into product is to be a very product focused engineer and make an internal transfer. I’ve been offered such a transfer because stakeholders knew me and that I was thinking about these things in depth. This overcomes challenges around trust and credentials you have cold applying with no prior experience in the role.
Apparently you don't understand how pensions work. Take a 401(k). Under normal circumstances what you take out of the 401(k) far exceeds what you put into it. This is what happens with investments generally speaking.

Saying, "Social Security beneficiaries receive more than they paid in..." indicates you don't know what you are talking about. And, believe it or not, Social Security does invest money.

And yes, it does salvage the argument. Defense spending (all of it not just DOD) is the largest expense of the government. This is expected when you are the hegemon.
I like its lazy approach

> I apologize, but it seems we're having some issues installing Chromium. As an alternative, since I can see Firefox is already installed on the system, would you like to use Firefox instead? Or would you prefer me to try a different approach to installing Chromium?

It seems unable to figure out how to install chormium. Sees the Firefox icon out there and just want to use it. You know, like a real lazy human being.

It seems to insistent when it needs to, though

> I clicked on Firefox and it should start opening. Let me take another screenshot to see if the window has appeared:

> Firefox seems to be taking a moment to start up. Let me wait a few seconds and take another screenshot:

> Let me try clicking Firefox one more time to ensure it starts:

> Let me try one more time to take a screenshot to see if Firefox has opened:

> Let me try starting Firefox using the bash tool as an alternative method:

> Firefox has successfully opened! As per the instructions, I should ignore the setup wizard and instead click directly on the address bar. Would you like me to do anything specific with Firefox now that it's open?

I didn't instruct him to ignore the setup wizard. So my guess is that Anthropic has configured it to ignore stuff happening on the screen so it doesn't go loose.

And here he goes through my website, through my hacker news account and then find this very comment

> Looking at his first/most recent comment, it's about a discussion of Claude and computer use. Here's what he wrote:

"I like its lazy approach"

This appears to be a humorous response in a thread about "Computer use, a new Claude 3.5 Sonnet, and Claude..." where he's commenting on an AI's behavior in a situation. The comment is very recent (shown as "8 minutes ago" in the screenshot) and is referring to a situation where an AI seems to have taken a simpler or more straightforward approach to solving a problem.
Not any longer. They now use a 105mm Howitzer among other means.

https://wsdot.wa.gov/travel/operations-services/avalanche-co...
Needs (2017) on title.
The title could be changed to "Corporate greed over decades led to a National Emergency" - and it would be more accurate.

But NO MORE BAILOUTS. Next time the US government needs to save something, they should take over the assets as an eminent domain, wipe out equity holders, and put a 10 year ban on all executives/board of directors who authorized share buybacks.
https://www.science.org/content/blog-post/where-drugs-come-c...

https://jamanetwork.com/journals/jama-health-forum/fullartic...

https://www.ineteconomics.org/perspectives/blog/us-tax-dolla...

Also, the prohibition on letting Medicare negotiate drug prices could be seen as taxpayer funded drug development, assuming that money were used to fund drug development rather than enrich shareholders.
Yeah they missed out the actual interesting bit from the readme...
>.... Is this meant to be a joke?

Are you a lawyer? I wasn't making a definitive statement, but if you have stronger evidence to the contrary please present them rather than making shallow dismissals.

>It's reasonably likely that they wanted it to only work on known devices with their private CA cert installed

It's an organization where BYOD is very common.
It’s easy to claim a lot of things.
> at the cost of having inconsistent gray colors

Which, to be fair, is a pretty high cost. The consistency of the greys that only differentiate on hover is half the aesthetic value of the effect.
>And many of those rights and abilities that you deride of unions have been hard won with literal blood and death by workers.

Unions provided no rights or abilities that I'm aware of. Laws restricting employment contracts to those that provide overtime pay are not rights. They're restrictions. People don't need a government telling them they can't work 10 hours a day at some given rate.

And no, it is completely irrelevant how large a company is: the worker has absolute negotiating power to reject any offer the employer makes. The only power the employer has in a free market to compel someone to work for them is to offer the employee terms that are better than anything else the employee can find in the market.

But what this ideology you espouse does is scapegoat the employer for the dismal options available to the worker, which would compel the worker to accept wages that you consider too low. On the basis of this scapegoating, you try to justify coercing the employer to provide a higher wage than they would choose to in a free market.

>And you're vilifying employees for exercising their rights to negotiate their contracts instead. Why should I be restricted from banding together with my fellow workers? After all, you're wanting a free market, which should mean freedom to associate or not.

I as an employer can choose to not associate with you and your band in a free market, and choose to only negotiate and employ workers who are not part of a union. But you don't want a free market. You want the government to commandeer the employer's assets and dictate to them who they choose to negotiate with.

>We've got quite a large population of people who would argue that it doesn't, because they don't have any capital or prosperity anyways. Can't lose what you don't have.

That's not how it works. Wages go up when capital increases, irrespective of how much capital the wage earners themselves personally own. Greater amounts of capital is why the US provides wages that are so much higher than the EU average. The EU's greater embrace of anti-capitalist ideology — which consists of the kind of authoritarian demands you're making here — harms workers.
>You need native apps

For native apps, you need users. For users, you need emulation.

It cannot be overstated how important successful x86 emulation is for the migration to anything else to be feasible.
Indeed! They've done a great job at muddying the waters. Otherwise knowledgeable people don't understand how this works.
Microsoft Dynamics as a Ticketing System
> Qualcomm is almost certainly ARM's biggest customer.

You think Qualcomm is larger than Apple?
I don’t see anything bad here, tbh (ignoring my acute allergy to react—alikes). The problem is not how they write. DX is a good thing. Interactivity too. The problem is what happens at runtime: fetch html, fetch script, fetch data multiple times. It should be fetch html which contains a script which contains all the necessary data and creates elements and sets handlers.
There is a chip out there that contains both an ARM and a RISC-V core, the RP2350. It's reasonable to assume that the ARM part and RISC-V part are manufactured in the same process. There are some benchmarks pitting the two against each other on e.g. this page: https://forums.raspberrypi.com/viewtopic.php?t=375268

For a generic logic workload like Fibo(24), the performance is essentially the same (quote from above page):

Average Runtime = 0.020015 Pico 2
Average Runtime = 0.019015 Pico 2 RiscV

Note that neither core on the RP2350 comes with advanced features like SIMD.
Then don’t be annoying about them. I do the exact same thing that guy talked about. Dark patterns get explicit 1 stars
Oddly enough stretching yourself at one tier of education can help you greatly in the next, as long as the grade penalty isn't so high as to prevent you from advancing.
They should buy the intel alumni founded RISC-V startup, and pour resources into a RVA23 based chip with dual on-chip SDR asic sections (they have the IP).

i.e. create a single open-chip solution for mid-tier mobile communication platforms.

They won't do this due to their cellular chip line interests. However, even if it just ran a bare bones Linux OS... it would open up entire markets. =3
It's.... awful. It's mostly just a slideshow of very AI-generated-looking art with some weird-enough looking aliens to not fall into the uncanny valley. The lip sync is not even close.
What are you worried about, zombies that want to eat your batteries?
Discovery of Memory "Glue" Explains Lifelong Recall: KIBRA Protein, PKMzeta