skysight-inc/HackerNews huggingface dataset:
The threat model is excellent, except: “The adversary can’t break standard cryptographic primitives”

Let’s assume they can and you can swap in non standard crypto models to frustrate and vex ‘the adversary.’ (Lol: “the adversary”… religious)

More info, the threat model:

All long-range communication channels (internet, phone network, etc) are comprehensively monitored by the adversary.

The adversary can block, delay, replay and modify traffic on long-range communication channels.

The adversary has a limited ability to monitor short-range communication channels (Bluetooth, WiFi, etc).

The adversary has a limited ability to block, delay, replay and modify traffic on short-range communication channels.

The adversary can deploy an unlimited number of devices running Briar.

There are some users who can keep their devices secure - those who can’t are considered, for the purposes of the threat model, to be controlled by the adversary.

The adversary has a limited ability to persuade users to trust the adversary’s agents - thus the number of social connections between the adversary’s agents and the rest of the network is limited.

The adversary can’t break standard cryptographic primitives
Yes the Google Business stuff exists for B2C marketing type use cases, but it is a very limited feature set compared to real RCS and cannot be used for regular communications using phone numbers.
* Resolves Bluetooth security issues (17 October 2024)

* Enhances the security features of the system software

* Improves Bluetooth connection stability

* Improves the hands-free calling quality

* Fixes an issue where the headphones cannot be paired on a Windows computer

* Fixes an issue where, when there are 2 Bluetooth devices connected at the same time, the connected devices repeatedly disconnect and reconnect

* Improves general performance of the headphones
My own skepticism that young attractive women are not likely to contact me keeps me safe.
I think it's "toe the line", like lining up side by side with everyone else on your team.
GitHub actions supports version numbers, version ranges, and even commit hashes.
The reset would be done physically. If there was some danger of the device being exploited after being reset, advice could be included for those performing the reset to prevent this.
For example, to not connect it to a network and to manually perform an update to the latest version with some physical media.
Yeah, I'm looking forward to having further conversations once I get to know tremor.
Apologies for a trivial question. I have an odd fascination about the edge cases of birthright citizenship.

If a non- citizen gave birth in an American embassy, would their child be entitled to US citizenship? What about US Antarctic Territory or aboard a boat within US coastal waters?
the second pic reminded me of the pale blue dot... it's a long way from home...
In your GitHub Actions YAML, instead of referencing a specific tag, you can reference a specific commit. So, instead of …

uses: actions/checkout@v4

… you can use …

uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
Interesting - hadn't considered that possibility - makes sense
Yes. Same with browser plugins. I've heard multiple free-plugin authors say they're receiving regular offers to purchase their projects. I'm sure some must take up the offer.
It's on F-Droid. I hadn't realized it supported message-passing over Bluetooth like FireChat! Not just Tor.
… or just walk right into the central Shanghai library and read the paper copy.

This is possible and I have done it many times.
Batteries aren't unrepairable; you wouldn't open one up in the middle of the road to try fix it but at the bus depot with enough volume of battery electric vehicles, they'll have reason to hire repair technicians that can refurbish and repair batteries.
The maintenance costs are only marginally higher per the report at $1.33 FCEB vs $1.15 BEB , $2.37 for Hybrids and $1.28 for Diesel (with additional public health costs for respiratory illnesses), the sample size(5x5) is too small to draw any meaningful conclusion on infrastructure costs or even reliability given the limited experience in operating anything not diesel.

Economics of hydrogen in CA are also complicated given our on-off approach to hydrogen infrastructure[2] for both personal and commercial vehicles but there is some progress on commercial side at least last year [1].

Hydrogen is not everyone but there are use cases for it.

The uptime (i.e. the refueling time) is an key factor [4]. Battery operated vehicles need a lot of downtime for charging thus you will need more vehicles for the same coverage. Fast charging can help but impacts battery life and thus TCO.

All green public transit are expensive. It is not a easy choice for administrators, should they improve coverage/ service frequency etc for their residents who need transit the the most or better air quality and less noise pollution for all of them.

Remember Fuel Cells are far cleaner for the air much more than BEV also, because it needs oxygen from the air FCs purify the air to do so. Kind of like having a big vacuum on the road in addition to not emitting direct pollutants[3]

[1] https://www.portofoakland.com/port-of-oakland-celebrates-hyd...

[2] https://www.energy.ca.gov/data-reports/energy-almanac/zero-e...

[3] Ignoring tire dust, it is problem for all vehicles of course, that is independent of propulsion systems

[4] Even for personal vehicles it can be a decision factor when considering going green, as an owner of a Mirai with no easy access to EV charging stations I have benefited from being to refuel like a gar car.
I wonder if there are also cultural/regulatory differences here.

I'm in the EU, and of course we had the forced shift to takeout as well, during covid. But while homeoffice as a concept stayed, restaurants very quickly went back to in-house dining when it was over.

Seeing a takeout-only restaurant with a repurposed dine-in area here in 2025 would be beyond weird and would probably just give everyone covid flashbacks.

Interesting to see that the specifics of what has stayed from the covid time and what has reverted could be different from country to country.
Sure but the “stable tools” are currently C and those projects probably build on a decade old distro. Replacing them with faster moving projects will hit issues.
This is horribly disappointing but I'm surprised the altimeter failed as I'd have thought this would have been one of the more reliable aspects of the mission.

How does its altimeter work, exactly what tech does it use? It's worth remembering that radar-type altimeters have been around for a long time and are well developed. For example, Little Boy that was dropped on Hiroshima 80 years ago used radar altimeters in a redundancy arrangement (four devices) and that worked on first attempt.

So what went wrong? Second question, was redundancy employed in the altimeter's design? Third, if the altimeter employed redundancy then why weren't its multiple sections of different designs to allow for the possibility that the reflected signal may be weak and noisy?

(The strength of a returned wave from a radar transmission depends on various factors including its wavelength and the properties of the surface it's being reflected from. If there's any doubt the returned signal's S/N would be such that noise could be a problem it'd make sense for a redundant system to employ multiple wavelengths whose frequencies are far enough apart to take advantage of the fact that the moon's surface would reflect different wavelengths in different ways and at different signal strengths.)
I started from Vim and ended up migrating my dotfiles to Lua. I was really glad when I bit the bullet because I was able to keep most of my favorite functionality but start using more of the modern Lua-base plugins. Lazy.nvim is a really great package manager— super simple.

I ended up stealing some LSP config from AstroNvim or another Nvim "distro". I've never tried committing to one of those prebuilds though. I was always hacking at my own configs. I do like to skim some of the code though because they are generally implementing much better design patterns. I'm sure that the community will do a better job than me with Lua 9/10...

The obsessive dotfile management does help to give you a deep understanding of your editor though— I will say that.
I think the assumption something is open source being a perk is naïve - in the end I still have to trust so many elements that actually bring me the platform that BW’s openness doesnt matter.
Basically it seems after expanding to >30 countries then realizing COVID growth would not continue, rationalizing operations, and figuring out the model of ghost kitchens is limited in growth potential with significant customer and platform backlash TK's been trying to automate the production side using the "former self driving team" of Uber at a Cloud Kitchen subsidiary called Lab37. https://www.lab37.us/ However, the (2023) pictures of their system show they are not very advanced, and news appears to have halted.

Why am I monitoring this? I personally spent 9 years actually doing mechatronic R&D in the food prep, packaging and logistics automation space in China with more aggressive footprint and automation goals and am currently raising for US based go to market on a far higher density platform that sidesteps the last mile delivery providers entirely. Email in profile.
Yup. Steaming is the way to go.
Literally still cheaper than the vast majority of anything that could ever be called or made into a home.
It wasn't a rapid decline. The media ignored it and covered it up but there were signs of serious cognitive decline even before he was elected.
The timing is perfect for drone delivery to make a big impact here. Meals could arrive fast enough to stay hot, so the quality of the food goes up while reducing delivery times too.

I don't get why companies can't figure out how to make this profitable.
There have been lots of attempts to automate kerning for decades. Most people seem to agree that they're still inadequate and that manual adjustments produce the best results.
Here's the link to that
https://news.ycombinator.com/item?id=40304666

Moral of the story: the "technical part" of things is not the end of the story

Alternative moral: The 3-2-1 backup rule of thumb is still alive and well (is your cloud account a single point of failure?)

Related: https://www.infoworld.com/article/2179073/murder-in-the-amaz...
Yeah, agree that one could / should definitely put it through evals if it were going to be a product. There’s quite a bit to a good evals program, though.

I think the main implementation challenge here - as in most of these things - would be how you retrieve / traverse the distilled documents. I think it’s hard to disentangle your distillation method from your preferred retrieval method. Surfacing stuff that’s relevant to a query is pretty trivial, surfacing that in a way that takes account of complex cross-document references, less so. All old-school search skills, though - suddenly (or soon to be) in big demand, no doubt.
> The big problem with things like Briar is that you can't install it after the internet has been turned off AND it is already unpopular

Sideloading an .apk is supported in all Android versions, right? Even without internet access? Is something more needed to install Briar?
Not sure what you’re getting at. An S3 bucket out-of-the-box is secure and can’t leak/be accessed publicly.

There’s legitimate use cases for making a bucket public.

What are you advocating for?
CI was sold as a solution for engineers having too much sovereignty. So that's what they got.
You can always just fork it and reference your own fork.
Did you turn off updates on your phone as well? Because 99.999% of people have app auto-updates and every update could include an exploit.

I'm not saying you're wrong not to trust package managers and extensions but you're life is likely full of the same thing. The majority of apps are made from 3rd party libraries which are made of 3rd party libraries, etc.... At least on phones they update constantly, and every update is a chance to install more exploits.

The same is true for any devices that get updates like a Smart TV, router, printer, etc.... I mostly trust Apple, Microsoft, and Google to check their 3rd party dependencies, (mostly), but don't trust any other company - and yet I can't worry about it. Don't update and I don't get security vulnerabilities fixed. Do update and I take the chance that this latest update has a 3rd party exploit buried in a 3rd party library.
Because drones are noisy and irritating in reality and nobody wants them flying around their neighborhood and they don’t scale and they can potentially scare animals and and and…
> Why didn't it rise to the same level? Maybe because he didn't actively try to sabotage an investigation into it.

That is tantamount to saying the issue isn't the mis-storing of classified documents, but that Biden didn't feel like threatened by an investigation from the Biden administration. Colour me shocked. That and the lawfare the Democrats were engaging in through the last election cycle was blatant process abuse and it was a relief that the attacks failed in such spectacular fashion.

This is a vocal mob of activists looking for ways to get Trump. If they want to do that by proposing general-purpose anti-corruption improvements and limitations on government then sure, that might be a productive path forward. But in practice it is going to be a bunch of measures that only target Trump because these people aren't worried about the abuse of power, in fact they were cool with it when it targeted their enemies. It has been an ongoing issue for at least the 20 years; since the Patriot act came into action. Probably longer. It hasn't suddenly sprung up because Trump won a second election with a bigger margin than last time. We know for a fact that the people who are serious about it have been unable to get much purchase in the political world.
With any database architecture the goal is to ensure that nothing hits your database if you can help it.

We served 13 billion requests last year, according to fastly, and burned 3.84PB of data.

Each one of those requests will generate a bunch of metrics, depending on what's happening.

To back that we have an Aurora db.r6g.large, which we've been using for a few years now. We just redid the metrics, so the CPU is now running at about 40% (it was at like 6% for a few years). Basically instead of aggregating metrics we moved to basically a time-series sort of structure.

The reason we can do that is simple: because we have no realtime requirement, we push all the requests through fastly, which pushes the logs to s3. Fastly uploads the logs to s3 every few minutes, and there's a lambda that chews through the logs whenever they show up. Usually there are like 10-15 of them running at a given time.

So really, by removing the realtime requirement we've been able to get away with getting our metrics for free (for the most part). In any case there's only like 5-10 minutes of lag, but since our customers generally look at yesterday's numbers 10AM local time it's not important.

So really, how big of a database do you need? With aurora unlimited storage you might as well use that. Do you need the data? At these prices you might as well keep all of it. Why not? Archive everything to s3, so you can rebuild it later (this has come in handy a few times).

From the UI, you need to eliminate queries until the user asks for them. Then limit the queries as much as possible. Use indexes. Ideally you'd pre-aggregate your data if possible.

For IoT, unless you need interactive responses just use HTTP GET requests into a CDN. No mqtt, etc. Why bother? And you probably don't have to worry about intermediate network devices clipping your GET requests, since you're deploying into someone's environment (make it a requirement for their network people).

For sizes and rows, they're not that big until recently. I think the biggest table has like 20-30 million rows? We aggregated stuff so our sizes were relatively small.

We have a monolith that handles the UI, api endpoints, and some maintenance things, and a bunch of lambdas that handles all the backend. Overall it's been pretty great; the backend that does work basically scales to some huge number. The real issue with lambdas is limiting concurrency so the DB doesn't get overwhelmed, and watching the memory/timeout numbers. Oh, and making sure that when you hook them up to SQS you don't let AWS fire up like 2000 lambdas (which works great for s3 processing, btw).
> While it can only emit one token in this step, it will emit "an" to make it consistent with its alligator knowledge "lurking".

It will also emit "a" from time to time without issue though, but will never spit "alligator" right after that, that's it.

> Sure, it derives from the prompt but so does every an LLM generates, and same for any other AI mechanism for generating answers.

Not really, because of the autoregressive nature of LLMs, the longer the response the more it will depend on its own response rather than the prompt. That's why you can see totally opposite response from LLM to the same query if you aren't asking basic factual questions. I saw a tool on reddit a few month ago that allowed you to see which words in the generation where the most “opinionated” (where the sampler had to chose between alternative words that were close in probability) and where it was easy to see that you could dramatically affect the result by just changing certain words.

> "an" gets a high probability because the model internally knows that "alligator" is the correct thing after that.

This is true, though it only works with this kind of prompt because the output of the LLM has little impact on the generation.

Globally I see what you mean, and I don't disagree with you, but at the same time, I think that saying that LLMs have a sense of anticipating the further token misses their ability to get driven astray by their own output: they have some information that will affect further tokens but any token that get spit can, and will, change that information in a way that can dramatically change the “plans”. And that's why I think using trivial questions isn't a good illustration, because it pushes this effect under the rug.
Organic can be expensive. The Aldi near me in Michigan has its half-gallon at around $5-$6 usually. Regular milk is around $2.50-$3.50 a gallon.
they're mocking us....
@dang: The original URL (from Step Security, the company that discovered this flaw) is a better source for this:

https://www.stepsecurity.io/blog/harden-runner-detection-tj-...
Erm, most file systems allow you to change data too, right? Hence S3 is emphatically not a file system.
The images are converted to an embedding space the size of token embedding space. And the model is trained on that new embedding space. A joint representation of text and images is formed.

It’s not as though the image is converted to text tokens.
You know they tear off all pages of negative CPC reports, right?
I don't see it that way. Not after years and years of noticing the pro-establishment bias. One example that still sticks with me is the coverage of the of the so called aid convoy at Cucuta, Venezuela. (As an aside, almost all coverage of Venezuela by the mainstream media is grossly deficient.)

The short of that story is this: Something happens. The mainstream media (including the Times) write about it in a way that is unflattering to the Venezuelan government (or whatever enemy du-jour is targetted). Weeks later, when it no longer matters, the Times prints a more accurate version, but still manages to be as uncomplimentary as possible. As the time itself said--two weeks later:

>"CÚCUTA, Colombia — The narrative seemed to fit Venezuela’s authoritarian rule: Security forces, on the order of President Nicolás Maduro, had torched a convoy of humanitarian aid as millions in his country were suffering from illness and hunger." (from https://www.nytimes.com/2019/03/10/world/americas/venezuela-...)

Independent South American journalists got it right. The UN tried to set the record straight about this aid convoy, the day after the event. But from the NYT, we got 'the narrative'. And that article that finally said Mr. Maduro didn't do it, came out two weeks later. By then the damage was done.

I've observed that same dynamic with other events as well, such as during the Bolivian coup attempt of 2019. The OAS manufactured a non-existent electoral crisis. No major US paper pushed back on that narrative, which was later shown to be an artifact of how the votes counting process--as the Bolivian government claimed all along, rather than any real crisis.

The Times simply can not be counted upon to give unbiased coverage in other situations either: Syria, Iran, Israel, Palestine, Russia, Ukraine, China, are all strongly biased with the official US narrative.

This is why I cannot subscribe to this paper. It is too often useless as a place where I can go to to get truth.
I wish Github required some sort of immutability for actions by default as most package managers do, either by requiring reusable actions to be specified via commit hash or by preventing the code for a published tag to be changed.

At the moment the convention is to only specify the tag, which is not only a security issue as we see here, but may also cause workflows to break if an action author updates the action.
Using a graphics tablet as a programming tool (2018)
> Tor also has its own vulnerable to traffic analysis which is quite significant.

[citation needed]

Here's a contrary one
https://www.theguardian.com/world/interactive/2013/oct/04/to...
Tasty tasty boot grime.
Yeah maybe we can merge with https://news.ycombinator.com/item?id=43367987
Very few people in my country use iOS devices. Maybe 5%.
People keep falling for the myth that this can be solved at a personal level or even national level.

People keep falling for the myth that we are making progress (we’re not).

Hydrogen powered busses are just a specific case of a much much larger communication/coordination issue…
A company I worked at went all in on GH too. The internal gh team probably going to do a fire drill this whole weekend and app teams forced to rotate all secrets and credentials.

Fortunately don’t have to deal with that shit anymore
not really cheap either.

I remember natural gas vehicles (busses and cars, like the honda civic). You could actually fill up at home if you had natural gas, but the electricity just to compress the natural gas for the car cost as much or more than the compressed fuel in the car.

For hydrogen, it is even harder. take a look at cars running compressed hydrogen. I remember $17 for the equivalent of a gallon of gasoline. I think it is even more expensive now.

Easier to burn CH4 than use energy to split out the H2, then compres it, then store it.

I actually think solar is better.
It’s hard to imagine it not. And also kudos and crazy respect for all the thousands of engineers that poured their work into making combustion engines as efficient and reliable as they are. A true marvel of humanity, and something to be respected even as we leave it behind.
That’s good to know - haven’t tried it, tbh, since they’re usually so poor, but will definitely check it out. Good stopgap solution.
A Carrington event ?
No it isnt. Because foreign companies and entities don't need to follow those laws. The whiney creative still losses. All they do is unsure that its their own country that doesnt benefit.
I don't think it's a coincidence that he is interested in non-LLM solutions, since he mentioned last year on Twitter that he doesn't have an internal monologue (I hope this is not taken as disparaging of him in any way). His criticisms of LLMs never made sense, and the success of reasoning models has shown him to be definitely wrong.
Good policy to fork all actions not owned by a reputable organization (e.g. github themselves).