skysight-inc/HackerNews huggingface dataset:
Suggestion for a compromise: Make it mandatory for TPM vendors to provide a user option to wipe all attestation keys and rebrand them as “embedded security keys” (and maybe promise to never use them for DRM, which per TFA nobody is anyway).

I feel like untangling the attestation capability (which I do believe has non-user-hostile/non-zero-sum uses!) from the secure key storage one might ultimately help their adoption.
And Paiste for the "much better" sound I suppose.

Been really impressed with Meinl's rise to competitiveness also. Used to not even exist in music shops when I was a teenager.
Heh. Nice. I like your zinger.

My go to metaphor has been "XYZ is an angry 800lb gorilla sitting between you and your work."
See also: Musk and others' critique of the movie Oppenheimer.
New Game + Mode Unlocked!
Good points. I'll only add that I just mentioned the Amish because it's the only culture ("subculture?") that I've read thoroughly about. But I think in collectivist cultures it is indeed much harder to be a bad actor. Perhaps we should have a little more shunning...
mullvad browser is pretty much this, but without messing around with containers. One fingerprint for all users, with the same font list, resolution, canvas behavior, etc.

https://mullvad.net/browser
Maybe you have inside info, but last we knew, Google needs internals for webRequest for its enterprise Chrome customers. I think this is not the dire situation your words convey.
You have to look around but better cars are out there. I bought a '04 Mercedes E500 for $4k about 2 years ago. Had about 160k miles, no rust. Was it perfect, certainly not. Had some wear and tear but fundamentally was a solid car. I still see them in this price range today.

I totally get that someone might not want to deal with the unknowns and risks of a 20 year old car.

Good to know that the charging efficiency is better than I guessed. I'll have to run the numbers again next time I'm needing a car. EVs have an appeal, no doubt. But for me they have to make economic and practical sense.
If you are in New Orleans, have you had any luck with Hacknight, the Nola devs Slack or BSides?
This gave me a good laugh. Thanks for that :)
> the only thing I’ve ever seen TPMs used for is full disk encryption and user authentication.

Aren't all device attestation schemes underpinned by authenticated boot which itself is underpinned by a TPM? This is certainly the case for Android - AVB is implemented on top of secure boot on all the devices I've ever owned (and Play Integrity, if I had ever permitted it to run, on top of that). Do I have some misunderstanding about the stack?

> Conversely, DRM is alive and well on almost universally TPM-less devices.

You mean software DRM I assume? Because the only TPM free hardware backed DRM that comes to mind is GPU based encrypted streams where the GPU does the decoding and final compositing locally. And even then the TPM-equivalent exists, it just isn't accessible to the end user.

SGX can be used to do various interesting things without attesting the state of the broader system, but none of the examples that immediately come to mind feel much like DRM to me.

> comments in this thread end up dead

Thanks for letting me know. I guess I should email them?
> Carrington founded and directs Berklee College of Music’s Institute of Jazz and Gender Justice in Boston. She’s also a Zildjian artist

What do you think they study at the Institute of Jazz and Gender Justice ?
> Practically speaking, is this sort of µop-dependent optimization implemented by compilers?

I suspect this specific thing is not; I don't think many people were aware of this anomaly until this week. I doubt the compilers are modeling it.

But in general, compilers will have a machine model that predicts the cost of different instructions. The backend will try to generate instruction sequences with low cost, so if you include this anomaly in the model it will probably work around it automatically.

This old example might interest you: a false dependency on the destination register for `popcnt` on some uarches led to compiler patches: https://stackoverflow.com/q/25078285/502399
there are better citations than tiktok, please.
But at least with Google captchas you can use AI to solve them. I use the buster captcha extension to solve them. It moves the mouse around like a human and solves automatically. I pay for captcha solvers for hcaptcha which is worse but cloudflare is just cancer. It’s made the web unusable
This has to be parody.
https://en.wikipedia.org/wiki/GNU_General_Public_License#Leg...

There are cases here where companies used GPL code without releasing their changes.

How do licenses of a source code check if the people using their code is complying with the license it uses?

https://www.reddit.com/r/embedded/comments/18gie6l/how_do_li...

The fastest way is often to just run the "Strings" program on the software. Often it will dump out a bunch of strings that match those in the Open Source project: Error Messages, Logging messages, etc. Sometimes if they're really sloppy it'll spit out the name of the GPL program/library directly and a version number.

I often add magic arrays to my code. So.. if I find them in a binary blob...

Have there been any lawsuits involving breach of open source licences?

https://opensource.stackexchange.com/questions/11452/have-th...
The reality is that only he can help himself. He's just facing the search he delayed up to now. It's good he's facing it. Most never will.
Reminds me of Peugeot. Cars and pepper grinders.
People already use github as a professional portfolio. Facebook uses real ID, and how popular is it?

> What does that mean? I thought regions only impact ranking not the net amount of stars (assuming we're talking about Apple/Google Maps). Which as far as I know, github doesn't do ranking.

At least on IOS reviews and ratings are by country, I dont actually know about google play though. (I dont have an android to check since I am not poor)
It's not true though (and no evidence that such a gate existed with that name).

It's more likely exaggeration referring to actual camel (the large animal of the area) and the eye of a needle (an example of the smallest hole one would be readily familiar with at the time).

If it was reffering to a named place, the very capable in both Jewish and Greek authors of the New Testament wouldn't have translated it as "τρυπήματος ῥαφίδος" (needle's opening) or "τρυμαλιᾶς ῥαφίδος" (needle's hole), as opposed to something like "narrow gate" or similar that would convey to people unfamiliar with Jerusalem the point.
Location: Toronto, Canada
Remote: Yes (5 remote experience)
Willing to relocate: No
Technologies: Python, Golang, Javascript, C
Résumé/CV: Resume available upon request
Email: skittle_22_halcyon@icloud.com

5+ years as software developer doing backend, full stack, devops and security related work, know reverse engineering and have a masters degree in cybersecurity.
There will be paid security updates from Microsoft [0], 0patch [1] (if you trust them), the LTSC version (which however takes you back to 21H2), and lastly you can still take your chances with just Windows Defender signature updates. I know a couple of people who still run Windows 7, including a security researcher (and not for research purposes), which still receives Microsoft Defender signature updates.

[0] https://learn.microsoft.com/en-us/windows/whats-new/extended...

[1] https://blog.0patch.com/2024/06/long-live-windows-10-with-0p...
Angels dancing on the head of a pin is another related one.

https://en.m.wikipedia.org/wiki/How_many_angels_can_dance_on...
How to Write Complex Software
No, more so.
I do my own maintenance and repair and don't spend anything close to that (not counting my time, but it's a hobby for me). Insurance and registration is also cheaper.
Oh thank god I thought we were at Wendy's
Lily AI | Remote, +/- 3hrs PST (US, Canada, South America) | Staff ML Engineer, Staff Software Engineer | https://www.lily.ai

We are a well-funded startup driving the next wave of innovation in product discovery and personalization. Our work spans exciting use cases such as deep product attribution, automated copy generation, streamlined item setup, and enhancing search and recommendation systems, among others. Our team of scientists and engineers specializes in Computer Vision and Natural Language Processing (NLP), tackling a diverse array of challenging and impactful problems. We take pride in leading the industry with the unparalleled depth of our taxonomy.

===================

Staff ML Engineer

Apply here: https://www.lily.ai/job/?gh_jid=6235560003

As a Staff Machine Learning Engineer, you will play a pivotal role in advancing our ML platform, encompassing data pipelines, training processes, and inference workflows. Collaborating closely with machine learning scientists, engineers, and product managers, you will help shape the ML roadmap, make critical architectural decisions regarding MLOps, and contribute to the company’s overarching AI strategy.

===================

Staff Software Engineer, Platform Engineering

Apply here: https://www.lily.ai/job/?gh_jid=6237871003

As a Staff Software Engineer, you will join a team responsible for developing the core product attributes platform. You will address challenges related to scalability, data integration, and building a high-performance backend infrastructure that powers outstanding user experiences.

===================

I am the hiring manager, feel free to reach out to me directly at anand AT lily DOT ai.
Long ago I was interviewing for an operations job, and their "leetcode" interview question was to create an invoice report of some fairly large public data-set. Because of the size of the dataset and the way they wanted it sliced and diced, it wasn't just a straightforward set of JOINS, and they clearly wanted you to do some simple SQL queries and then have some code loops that sliced and diced it all.

That wasn't a solution the data scientist in me (which I'm not) was ok with. I ran my high level thoughts about the problem past a data scientist buddy of mine and he said "sounds like you're on the right track", but not being a data scientist it was hard for me to put together a soludion.

I told them that if I was asked in my work capacity to do something like this, I'd probably be reaching for a reporting package like Crystal Reports, but I haven't touched it in ~30 years. "Sure, I get that, just write some code to generate the report".

I had written all the Ansible and related goodies to spin up an instance, get MySQL set up and configured, and figured the "right" solution was there in the SQL arcana. I played with it and played with it, mostly writing off the job because what kind of company judges a sys admin based on building a reporting package? They had set the expectation that the homework should take 2-4 hours, and I chewed on it for longer than that and finally said "thanks but no thanks, this is outside my wheelhouse".

But I kept chewing on the problem. A couple weeks later I had the right set of materialized views and queries and joins that not only solved the problem entirely in SQL, but solved it QUICK.

SQL is amazing, but there are a log of tricks of the trade you've got to have at your fingertips to make it fly. I'm still convinced that a lot of it is just throwing a bunch of things at the wall until something sticks.
I am really, really eager and excited to see the result when these DOGE-istas cook up whatever insanely “rational” schemes they imagine will make government not completely “dysfunctional” roll them out to the people they actually need to implement them (i.e., Congress).

Surprise! Politicians only claim to care about budget and spending matters when the opposite party is in control.

But I think most of us aren’t so naive as not to realize DOGE is just and only another way to troll Democrats, not actually a serious way to tackle our fiscal and budgetary problems. The past n Comptrollers of the United States have been banging away on that policy drum for as long as I’ve been paying attention to politics (beginning ca. 2000). Nobody cares. They write nice reports though.
Just a heads up: your Greenhouse has captchas incorrectly set up that make it impossible to apply on various browsers I have tried it on, even with ad blockers and such disabled.
Let's not forget regressions in gaming performance. This is my number one issue, and the devices I do have Windows 11 on arent changing my mind, and I suspect this holds true for many others out there.

Why upgrade if I just get downgraded?
How the hell is this not the top post?!
Be careful what you wish for, because you just might get it.
If Net Neutrality is a test case for whether science moves too fast for a bona fide, representative legislative process and should be handled instead by broad grants of power to executive appointees, then I'm comfortable picking the side of Congress over the administrative state. I think we probably agree, though, there are better cases to highlight the utility of regulations over laws!
We make crypto opt-in, so I'm curious what was a nuisance. Was it something in the UX you couldn't turn off? Or sponsored images in new tab pages? Both possible, genuine q.
I am interested in affordable housing. Is inefficient tech the biggest contributor to housing cost?
Children are pretty good at providing you with purpose too if you lose yours.
I don’t think his problem is money.

I think his problem is his identity (founder of Loom) suddenly disappeared.

Now he needs to develop a new identity.

This is especially difficult for single founders without kids (in the sense that people with spouse/kids already derive much of their identity from those 2 things).

Selling a company isn’t all that different from going through a divorce (in the sense that your identity needs to be completely rebuilt from scratch)
Ehhh... maybe...

Last week I had a run of (legacy) Cloudflare captchas on sites protected by CF to solve of "select all the boxes with motorcycles in", and despite doing it fastidiously and correctly (although I never know how to handle the boxes with like 3 pixels of object in but are otherwise clear), I had to do it like 5 times with different images, until suddenly it was happy.
You know what I got from this story?

DOGE already processed a lot of applications and set up the signal chats etc.

This guy applied and right away heard back, because he has millions of dollars, good reputation for having a large exit, and he "reached out to some people and got in".

I simply applied in the way they asked -- DMming them on Twitter -- the very next day, submitting a link to my resume, background and cover letter that fully spells out how exactly I could help them in their mission. And they didn't even bother to visit the link, let alone respond. (I know because I put in logging.)

Until now, I didn't know that DOGE was even hiring people yet. Now thanks to his story, I believe they've already hired the main people back in November.

I am going to take a different approach in life. Thanks guy :)

Capital matters. Connections matter. Timing matters. Substance doesn't matter as much, sadly. Don't simply follow instructions. Get unfair advantages.

For what it's worth, here was my DOGE application link: https://magarshak.com/resume-cover-letter.php
If there's some rich person willing to give this idea a shot: I can help by taking one of your many millions from you.
My buddy claims he trades exclusively Tesla. Given the CEO’s volatility and the regular bounce the stock graph makes a sawtooth pattern.

I don’t believe him though. It takes a lot to sell when everything is going great and buy when something goes wrong.
> I deeply regret this mistake and will take steps to ensure it never happens again.

I always get a little... sigh-y when I read statements like these. What steps? I'm not even sure what I would do to ensure something like that wouldn't happen again. Build some automated tooling to run the software that exercises every single feature it has, and capture system calls to ensure that it never opens or writes to files? That sounds like a very difficult thing to do (to the point that I wouldn't even try, especially for a GUI app), but anything less doesn't feel like you can ensure it won't happen again.
> It's very familiar...

It is? Because as far as I can tell it is deliberately quite different from iTerm2. No GUI for preferences, for instance.

Not knocking it, it's a great terminal. I wouldn't describe it as "familiar" though, unless you're switching from, say, WezTerm or Alacritty.
Awesome Donations: A repository of FLOSS donation options
> "eye of the needle" refers to a small gate or passage in ancient city walls,

There's a lot of discussion on this verse. Apparently, the gate interpretation didn't exist until the 11 century.

It was rethought to be Rope for a while but this blog post discredits that. https://kiwihellenist.blogspot.com/2023/11/camel.html
It does not support tabs, for one.
connet is a young project, and draws inspiration from many great projects like yours. Thanks for sharing it, I starred it!
> With some effort, you can use local account

For now. Microsoft has been trying to close that for a while, and I suspect the only thing keeping some of it alive is the stark security requirements some of their corporate/business customers mandate.
>> This is such an American thing that I find it hard to respond to,

It is actually a thinly veiled sociopath/psychopath/narcissist that has fully bought into hyper-capitalism being the endgame of humanity thing.
Earning gray hairs with blood, sweat, and tears is the natural way of marking satisfaction milestones. Most of us will not get a chance at steering just 1M in wealth without major struggles and juggles. But having 60M without any major struggle? Well now you have to struggle with an existential crisis. Here's the solution: Watch your children grow to adults, sail some seas, and fix anything that bothers you. Life always finds a way of keeping you active. Now it doesn't actually matter what you're doing, as long as you are happy to be doing it.
GovPro AI / Unanet | REMOTE (US) | Full-Time | Software Engineer (AI)

We're using AI to automate the procurement cycle for the US government. We mainly work with contractors to speed up the search, research & proposal drafting parts of the bidding process. We were recently acquired by Unanet and have exciting plans making use of the latest developments in multimodal models and agentic frameworks.

Looking for TypeScript engineers with experience using Vue. Experience using AI models, building in Palantir Foundry, and deploying in AWS are all a plus. Clearance is NOT required but a huge plus.

Base salary range is $135,400 to $157,500 (excludes bonus and stock).

https://job-boards.greenhouse.io/embed/job_app?for=unanet&to...

Mention you were referred by @cuuupid in your application!
It’s a shame that Americans don’t reap the maximal benefits from it, but why should the hegemon not take advantage of lesser states?
Great idea but I don’t know anyone who will pay for that.

Ones that care enough already have their internal tools and processes for security and checking/reviewing libraries.

Ones that don’t care well won’t spend money on it.

So any 3rd party would have to do all with own resources and not getting paid.
The past article discussed in this case study is available here:

"Google, the search engine that’s forgotten how to search"

https://news.ycombinator.com/item?id=42446995

https://semking.com/google-search-real-user-feedback/
Looking for a top tech team - where most of the engineers are senior, with no need for leadership.

Location: Australia-Sydney

Remote:YES

Willing to relocate: YES For European Timezone Only

Technologies:

FrontEnd: ES6 - React/Angular/Vue/Solid/Svelte

Backend: Go, Node, Rust

Résumé/CV: Started learning by myself in 1995 at 13yo, and I didn't stop since then

My resume is so long that I get flagged as spam all the time.

Email: ninja@datapond.earth
I recommend focusing on (1) health and fitness (2) community / volunteering (3) charitable foundation (4) art - create it or support it.
Recent research from Killingsworth and Kahenman in 2023 [1] highlights that those most already happy have their happiness accelerated by money, while those most unhappy have their happiness plateau.

This makes some intuitive sense to me. Money provides freedom, but freedom is not happiness. It's freedom to explore, which is quite scary in and of itself. But if your mindset is proper, your creativity and appetite for exploration will be unbounded.

[1]: https://www.pnas.org/doi/10.1073/pnas.2208661120
I absolutely hate cloudflare for the same reason you have. Besides traveling and using a VPN, I like in Hong Kong, a country that many sites have decided to block completely. It's very frustrating that cloudflare easily enables those kind of blanket bans for no reasons.

Cloudflare is the enemy of open web.
Show HN: Minimal e-ink habit tracker
From what I understand, this is actually highly debated among biblical scholars.

This idea that he meant "it's hard but not impossible" seems to generally be pushed by wealthy religions and "prosperity gospel" types.

Reading everything else Jesus said, I find it more likely that he literally meant the "eye of an actual needle". He did not seem to be a fan of the rich or powerful in any way.
Given that this forum is the news/blog discussion forum attached to a startup accelerator and VC fund, what I find pleasantly remarkable — and I mean this sincerely — is how open people here are to the idea that capitalism might possibly not be perfect.

If I had not seen this forum for myself, and only read about it second-hand, I would have assumed that most here would indeed think they are "perfectly congruent" (which itself is a much starker position than simply "being a fan").
One fun thing about this is that spilling+restoring the register will fix it, so if any kind of context switch happens (thread switch, page fault, interrupt, etc.), the register will get pushed to the stack and popped back from it, and the code suddenly gets 3x faster. Makes it a bit tricky to reproduce reliably, and led me down a few dead ends as I was writing this up.