skysight-inc/HackerNews huggingface dataset:
Seems like their malware relies on a couple of things:

- intended target is KDE and GNOME

- privilege escalation through LD_PRELOAD hooking from userland via open, stat, readdir access (of any other program that the user executes, see down below)

- persistence through display manager config for KDE

- persistence through desktop autostart files for GNOME

- fallback persistence through .bashrc, profile or profile.sh in /etc

- installs trojanized ssh client version

- installs a JSP webshell

- sideloads kernel module as libselinux.so and .ko module. Probably the rootkit helpers to access them from userland

Despite the snarky comments in here, this malware is actually quite sophisticated.

If you don't agree, I challenge you now to measure the time it takes for you to find all .so files on your system that are loaded right now, and have been modified since your package manager installed them.

My point being that there is no EDR on Linux that catches this (apart from ours that's WIP), because all existing tools are just checking for windows malware hashes (not even symbols) as they're intended for linux fileservers.
You don't have to settle for the default limits. Simply request more.
That only works if your application has reasonably few users. Otherwise, your upload will result in some requests hitting a partially completed code base overwrite, that is, only some of your changes have been uploaded at request time, possibly leading to an error. This is a nice strategy for a hobby project, but it plain does not work for a business.
Your HN comments.
Please fix title: Amazon S3 Express One Zone now supports the ability to append data to an object
OS companies (particularly microsoft, who maintains a chrome fork already) seem like a good bet.

There are other browser companies (brave, opera, etc) who might be interested, though it would be quite a gamble for them to buy chrome in my opinion.

There's a lot of software based on top of chrome (via electron), which means a lot of money that cares about what happens to it, which could easily influence things.
The current Australian Labor Prime Minister is well on the way to being the worst PM Australia has ever had, and that is in his first term.

The potential alternative seems unlikely to be much better.

Admittedly both them have inherited serious structural issues that go back almost two decades to the next closest contender for worst PM ever, John Howard.

But coming home and finding your house is on fire is no excuse for just throwing petrol onto it.
Congrats on launching, but it'd be awesome to have an e-mail-only registration option.
I’ve been using owntracks for a while now, and while it is pretty decent in terms of accuracy of data collection, it unfortunately lacks in the nice things that make Google Location History so good: automatic clustering, grouping, search, classification of trips and travel methods.

The initial setup is slightly annoying as well. Here’s a small write up from me: https://sathyasays.com/2024/07/13/self-hosting-owntracks-goo...
I don't understand the bashing in the comments. I image this is a tough distributed systems challenge (as with anything S3). Of course AWS is charging more since they've cracked it.

Does anybody know if appending still has that 5TB file limit ?
This is great work! Mechanistic interpretability has tons of use cases, it's great to see open research in that field.

You mentioned you spent your own time and money on it, would you be willing to share how much you spent? It would help others who might be considering independent research.
There's no need to lie. Lithium battery fires are a fucking nightmare.
That advice doesn't always work in real life; otherwise for every compiler or linter check in any language, we could drop all those checks and tell the programmers not to do that.

E.g. if a base class declares a variable it can potentially break its children. Whose at fault here?

I agree with your original comment though. And if the bypass of exisitng fields is badly wanted, somehow marking __get to disregard them makes more sense to me.
This sounds like a thin wrapper over an underlying object store
I think the rewrite aimed to simplify installation and configuration. TW 4.0 switched from PostCSS to LightningCSS [1], and Rust-based tools tend to offer a simpler setup via single binaries (in contrast to the complexity of typical JS-based tools).

Moving from pure JS to Rust also brings performance gains. Even if the main goal wasn't "performance," it's a nice side effect worth highlighting.

--

1: https://lightningcss.dev/
> Did they really think that when they talk Hebrew to their audience, rest of the world does not hear them. Case like this would be harder to prosecute without evidence of intent.

What are you talking about here? Link?
I really dont want to access a property and have it do any sort of magic behind the scenes. This is just bad. Now a property lookup could do some IO, or even throw an exception. PHP should not aim to please the framework of the month, but it in fact seems like Laravel lobbied this into PHP core.

> but you’ll never have to use them

But i do. I now cant tell if im accessing a property or a getter. With custom functions (like getFoo()) it was annoying, but still obvious, now its just magic and library authors will 100% start to abuse this feature allover.
Companies are spritzing smells in office to make return-to-office more pleasant
Aralkum Desert
You really think this protest exists in a vacuum, totally detached and isolated from the context of the broader Israeli led genocide against Palestinians? Ok.
Accidentally removed the air quotes around "accidentally" ?
>OS companies (particularly microsoft, who maintains a chrome fork already) seem like a good bet.

Great, so we go right back to the days of IE6. No thanks.

>There are other browser companies (brave, opera, etc) who might be interested

These companies are viable because they get to outsource the bulk of the browser development and maintenance to Google for free. I don't think they can afford to buy and run the whole browser.

>There's a lot of software based on top of chrome (via electron)

This is honestly the best scenario I can see of all the discussion I've read about this, and I'm surprised I haven't seen it brought up before. Still, from what I read on Wikipedia, Electron was spun off from Github (owned by MS now) and is run by a foundation with a bunch of tech company members, so going from this to a whole for-profit company for something that is basically just an open-source wrapper over Chrome's engine seems unlikely.
Ecobee does this well imo
Sure. I'm just explaining why more men are homeless than women:

>Sixty-seven percent of all people experiencing homelessness within the 2018 Point-in-Time (PiT) Count are individuals. There are 260,284 men compared to 106,119 women. Thus, men are the majority of individuals experiencing homelessness (70 percent) followed by women (29 percent).

https://endhomelessness.org/demographic-data-project-gender-...

From what I see, there is no state that skews so far that women are even close to a majority. The worst cases still almost have a supermajority of homeless men.
That alone wouldn't be able to account for it. The Model 3 would need a fatality rate about a third as much as that of the Model Y to pull the average that far, seeing as the Model S has a fatality rate close to the Tesla average, and the Model X is very rare compared to the 3 and Y.
Doesn't mean we

a) can't hope

b) shouldn't hope
Voting-age women outnumber men in the US, and women both register and vote at a higher rate than men do.

See: https://www.census.gov/topics/public-sector/voting.html

See also: https://www2.census.gov/library/publications/2024/demo/p20-5...

The reality is that a significant minority of women overall, including majority of white women (53%), voted for Trump in the recent election.

See: https://apnews.com/hub/election-2024
> It really feels like the DOJ has it out for Google here. Apple's behavior is far more monopolistic, and Microsoft is no saint either.

As others have mentioned, the government can do more than one thing at a time. Here is a list: https://www.nytimes.com/interactive/2024/business/antitrust-.... Perhaps Google's case had just progressed faster, and perhaps it was more clear-cut or easier to prove.

Google's records retention policies were also over the top and perhaps hurt it: https://www.nytimes.com/2024/11/20/technology/google-antitru...:

> But Google has faced the broadest criticism for its actions, with the judges in all three antitrust cases chastising the company for its communications practices.

And they engaged in some pretty sketchy practices:

> If using the right words and deleting messages did not keep Google out of the courthouse, the company concluded, invoking the lawyers would....

> A message surfaced in the Epic trial in which a Google lawyer identified the practice of copying lawyers on documents as “fake privilege” and seemed rather amused by it. Mr. Walker said he was “disappointed” and “surprised” to hear that term....

> Last month, three advocacy groups, led by the American Economic Liberties Project, asked for Mr. Walker to be investigated by the California State Bar for coaching Google to “engage in widespread and illegal destruction” of documents relevant to federal trials.
Lot of downvote for my curiosity
This is why the "cloud" model of AI is not really where I would want to be as a business.

Admittedly you are not going to get the same cutting edge performance, but I would only be basing a business on an AI I could download and run on my own hardware, such that at least current performance could be guaranteed going forward.

Anytime you buy anything as a service, you are in danger that due to malice, incompetence, lack of profitability, competing with a greater or established interest, or many other reasons, that service may become unavailable at little to no notice.

I don't understand why companies put themselves at these risks, when it comes to software as a service components to their business, when they wouldn't dream of exposing themselves to similar risks in any other domain related to their well being.
The last Trump administration passed a tax change that took effect in 2022 and forced all software development costs to be amortized over 5 years. So in a simplified scenario if a company makes $110k and spends $100k on software development ($10k profit), they are now taxed for an income of $90k.

This has been a predictable disaster for smaller software companies that rely on revenue to pay the bills. I guess since this is a puff piece they didn't feel it was worth mentioning.

https://www.thomsonreuters.com/en-us/posts/tax-and-accountin...
> There’s no reason to imagine that the web will do bad things with your resources that you didn’t ask for and don’t have control over.

Read some security update news from browser vendors and vulnerability researcher posts. There's some weak signals about vendors acknowledging the difficulty of securing the enormous attack surface of browsers built on unsafe foundations, eg MS "enhanced security mode" and Apple "lockdown mode".
Most engineering students search for topics like Stress, Strain, and Torsion in Circular Shafts on Google. If you're also looking, get all Strength of Materials video lectures in one place—Magic Marks. Perfect for semester and competitive exam prep. Learn anytime, anywhere with our expert-curated video lectures.
Thank you! I'll keep en eye on Eigen too! I'm curious how it will work out with Slint.
Not directly, but enough to write once every hour for more than a year!
Apple will now be treated like a bank
in addition to the reply previously left, it also comes down to age demographics. Women are a lot more likely to "date up". Or perhaps men date down.

Either way, when you have some portion of the 18-24 women dating men in the 25-34 demographic, that skews the portions for 18-24 men. Men who obviously can't date down and are much less likely to date up.

As another bit of trivia (but not likely to change major statistics), women are slightly more likely to be gay than men.
For better or for worse, people (the masses) adopt technologies based on actual usefulness, the product experience, and trust. Most people's actions tend to disregard social/environmental impacts of a technology. This is why airtravel is popular even though it's terrible in terms of CO2 efficiency. This is why people use Amazon and Walmart while driving out small family businesses.

If you look back over the last decade, pretty much all uses that have been invented on top of blockchain technology have been overhyped in terms of actually widespread REAL world utility. Ideas like NFTs, DAOs, Smart Contracts, etc. are cool technological solutions to a number of problems, but they are not THE ONLY solutions to the problems that they solve. I.e. the problems they solve don't necessarily need a blockchain or real decentralization, and blockchains still make for a rather clunky and confusing user experience.

Contrast this with the solution of a truly decentralized way of electronically transferring funds instantly(ish) and without regards to intermediaries, laws, or borders. THIS solution exclusively solves a number of very real world problems that other solutions just can't (Traditional banks, CCs, PayPal, e-Gold, Liberty Reserve, etc.). Having a centralized system mediating financial transfers can create lots of problems in certain situations. (In other situations of course, centralized financial systems are nice).

In this regard: Bitcoin does a perfectly good job, is the most established, and has the most robust decentralization. It's fixed supply, whether or not overrated in actuality, certainly helps psychologically drive adoption, which creates a feedback loop (more adoption -> more trust). It's founding story also adds the the long-term trust as well. Being the first of its kind and totally out of left-field, there are none of these shenanigans with the currency being developed by VC-backed companies or founders pre-mining a ton that may be in conflict with the public interest.

While Bitcoin may not be "the best" or "sexiest" in certain technological factors (e.g. energy consumption, smart contract capabilities, etc.) compared to other blockchain technologies, it does a job and it does it well. I would be careful to not conflate how advanced a competing technology is with its actual value.
Ask the Australian government, they are experts.
UFOs and Defense: What Should We Prepare For? [pdf]
Bummer. It would be nice not have all battery eggs in China's basket.
How does Tailwind handle responsive design issues better than CSS? Assuming of course CSS where the devs know how to use clamp.
The standard isn't harm, it's war crimes. There is clear evidence that Israel deliberately withheld food and medicine from civilians in a calculated manner, which is a war crime that no one is alleging in the fight against ISIS.
Pidgin 3.x is using a proper secret store:
https://developer.pidgin.im/wiki/KeyringSupport.html

Yes! This is great news.
If you want to try new things out and move fast with your CSS, you're not building the entire system. It's a partial build and that was already faster than you would even be able to react. Your browser refreshing would take longer.
Figma, my dude
Seems perfectly reasonable to me?

If you are on /somepath I'd expect to get C as is the most specific value out of all three. All the values are still returned, ordered, which to me is the best of both worlds (path-specific values + knowing the globals)

The only thing I don't like is the magic `document.cookie` setter, but alas that's nearly 30 years old.
I had an update for Safari, not Sonoma.

The update to Safari was 18.1.1 according to

softwareupdate --history
I’m not an expert in BNNs but the prior does not need to be justified in terms of each parameter. Bayesian analysis frequently uses hyperparameters to set the overall tightness or looseness of the parameters (a la Minnesota priors in the econometric literature for example). This would be a similar regularisation intuition as, eg, L1 and L2 regularisation in traditional NN training. This is of course just one example.
Given who and what is about to once more penetrate the oval orifice, Putin isn’t just going to come out unscathed, he’s going to come out with a significant part of Ukraine, ready and willing to take more, and entirely capable of streamrolling through Europe.

And that’s despite the fact that, were this actually an ICBM+MIRVs (as opposed to one or more IRBMs or MRBMs) then it appears to have gone limp.
Bear's Neuroscience: Exploring the Brain

Purves's Neuroscience

Kandel's Principles of Neural Science (grad level, but really the bible for neuro)

Dayan and Abbot's Theoretical Neuroscience (good for compneuro)

The Art of Electronics, 2nd edition (cheating here, but it's good to go back through the fundamentals before going into the edge cases that is neuro)

In general, AI is so new that there really isn't a good classical text between AI thingys and neuro. It will take time to suss one out and write one.
Linux, especially wayland, is making keylogging and keypress manipulation really hard. This is hitting me in one of my passions: retro gaming.

I WANNA DO MACROS, but I haven't found any good solution for macros in linux (think dragon punch in Street Fighter or some other complex HID input sequence that teenies can master but oldass me can't)

And I understand why, it's a massive security problem, giving view powers to the keystream, to say nothing of manipulation.

I hope that retroarch eventually adds it, but they punt on it currently I think for the exact reasons I have problems with it.

Does anyone know any good solutions out there for X.org and Wayland?
It does, actually. Secondary sanctions are an impediment to free trade and frequently argued to contravene against international law as a result. You could take it up at the WTO if the US didn't just destroy it a couple years ago.
Old Spring versions < 6.1 are obsolete, so you do have to upgrade Spring in many scenarios as well. No security fixes for them unless you pay for support.
I agree with you, Bevy is a worthy cause.

Why are people downvoting? The idea of Great High Performance Graphics Effortlessly on All Platforms is very appealing. It is fundamentally empathetic. It is an opium to game developers whose real antagonist is Apple and Nintendo, and who want a more organic journey in game development than Unity Learn. Is it a realizable goal? Time will tell.

Everyone should be advocating for more focused efforts, but then. Are you going to say, Bevy is better than Godot? It’s subjective right? Open source efforts are already spread so thin. An inability to rally behind one engine means achieving 2013’s Unity 5 level of functionality is years away.

Looking at it critically, in fact much effort in the open source ecosystem is even anti games. For example emulators used to pirate Nintendo Switch games have more mature multiplatform graphics engine implementations than Godot and Bevy do. It would be nice if that weren’t true, you might tell me in some sense that I am wrong, but c’mon. It’s crazy how much community effort goes into piracy compared to the stuff that would sincerely benefit game developers.

WebGPU is authored by giant media companies, and will have purposefully hobbled support by the most obnoxious of them all, Apple - the one platform where it is kind of impractical to pirate stuff, but also, where it is kind of impractical to deliver games through the browser. Precisely because of the empathetic, yet ultimately false, promises of WebGPU.
Yes in math. Formalisms come after casual thoughts, at every step.
Understanding CSRF in Depth
I disagree with one conceptual point; if you are truly Bayesian you don’t “choose” a prior, by definition you “already have” a prior that you are updating with data to get to a posterior.
When I was in undergrad, I worked with Barry Wellman (one of the early proponents of Social Network Analysis). One of his research projects back in the 1970s-90s was interviewing people about their home offices, and they'd have them take photos of their desk, computer setup, etc. Really cool stuff to see how people decide to focus. I wonder how much it's changed?

This is a nice article going in the other chronological direction!
It's crazy to me that anyone would still consider S3 after R2 was made available, given the egress fees. I regularly see people switching to R2 and saving thousands or hundreds of thousands by switching.
Google Earth Engine shows a timelapse of the Aral Sea dying between 1984-2022 [0].

[0] https://earthengine.google.com/timelapse#v=44.41071,59.77031...
The Rust Foundation's 2nd bad draft trademark policy
What is 'UQ', I assume some measure of uncertainty over your model outputs?
Yeah, they are both organizations with very high integrity and credibility...? Kind of perplexed what your worldview even is.
If you want to store language preferences then that means you only know client side and you can't serve html in their language
Can you give me a link to this 1.3 gbps radio product? I have some Alcatel radios with waveguides on a licensed band that only do 50 megabit that I would upgrade if there was something that could get more bits out of the same bandwidth and towers.
This will require some serious buffering.
An anecdote — I recently upgraded an old NodeJS project written using v14 to 22. It used an old version of Svelte for the UI. It wasn’t too bad, took about 90 minutes to upgrade a bunch of Svelte 3 components to Svelte 5, with some assistance from Copilot.

This was with zero awareness of Svelte 5 (I only knew it was released — I wanted to upgrade because Node 14 is EOL now and I’d noticed some npm audit warnings.) So I feel I also learned something in the process.
They don't understand what it means to be physically dangerous.
Yeah I went down the rabbit hole of trying to rewrite all our shaders to work on webgpu’s crazy low limits. I’m embarrassed to say how long I worked that problem until I tried requesting higher limits, and it worked on every device we were targeting.

The default limits are like the lowest common denominator and typically way lower than what the device actually supports.
Slouch: Posture panic in modern America
I think the whole civilized/uncivilized spectrum is just “who has bigger gun” contest.
Tell me, how else do you currently do business without agreeing? You are the fool to think you can engage in anything without some tos involved.

This is why consumer protections need to be put in place.
> ranked-choice voting is almost certain to lead to more upsets

How is that? In areas with near-50-50 splits the current system promotes "upsets" by minor party spoiler effects. Ranking mechanisms--like runoffs--would make the results more predictable, rather than less.
Look up the stats on criminals and single mothers.
Misinformation expert cites non-existent sources in Minnesota deep fake case
I wonder how much of that is all the WWII vets being gone and not being able to hear their thankfulness at not having to invade Japan the hard way (after what happened on Iwo Jima and Okinawa).
Usage statistics of server-side programming languages
They are not alone, apparently Ford is closing down EV factories due to lack of sales.

Get the prices down, and people will buy EVs.
YMMV but I find ‘lg:…’ to be much better than ‘@media (min-width: 992px) { … }’ at the expense of repeating ‘lg:’ every class. Since most components don’t need too many responsive classes per breakpoint, this is a net benefit most of the time (and nothing is stopping devs from combining utility classes and custom css with media queries).

Like GP said, this kind of specificity is impossible in inline styles altogether which is relevant when not using CSS-in-JS in React et al.