skysight-inc/HackerNews huggingface dataset:
The paper significantly overstates the scope of PAC (pointer authentication codes) on Apple platforms. To quote the paper:

> This is effectively what is done in Apple software, which uses special ARM hardware support to also check pointer integrity at runtime—i.e., ensure each pointer access uses pointers of the right type[]. Apple uses this further to enforce a form of stack integrity, control-flow integrity, and heap integrity

In reality, the compiler only automatically applies PAC to code pointers: stack return addresses, function pointers, and C++ vtable method pointers. You can also manually apply PAC to other pointers using attributes and intrinsics; this is used by components like the Objective-C runtime and the memory allocator. But only a tiny amount of code does this.

PAC is nevertheless a powerful mitigation. But let’s see how it stacks up against the paper’s claims:

- Heap integrity:

Since Apple’s implementation of PAC leaves most data pointers unsigned, it has little direct relevance to heap integrity. The paper seems to want to sign all pointers. You could theoretically implement a compiler feature to use PAC instructions for all pointers, but I don’t think anyone (not just Apple) has implemented such a thing. It would probably come with high performance and compatibility costs.

- Stack integrity:

The paper defines this as “attackers cannot change the arguments, local variables, or return sites”. PAC makes it difficult to change return sites, but does nothing to prevent changing arguments and local variables (unless you're limited to a linear overwrite). Again, it's theoretically possible to use PAC instructions to secure those things: there is a technique to make a single signature that combines multiple pointer-sized values, so you could try to make one signature that covers the whole set of local variables and other stack bits. But nobody does this, so the compatibility and performance costs are unknown. Even SafeStack (which the paper also cites) does not fully protect local variables, though it gets closer.

- Control-flow integrity:

The paper mentions “type signatures”, but Apple’s PAC-based CFI does not validate type signatures for C function pointers, only vtables and Objective-C isa pointers. Other CFI implementations do validate C function pointer type signatures, like Android, though this seems to come at the cost of a slower pace of adoption.

More importantly, attackers have demonstrated the ability to get around CFI, by substituting valid but irrelevant function pointers to achieve “jump-oriented programming” (JOP). Project Zero recently published a blog post explaining a (semi-recent) iOS exploit that used this technique:

https://googleprojectzero.blogspot.com/2025/03/blasting-past...

I’m not sure whether type signature validation would have prevented this particular exploit, but many C function pointers have pretty simple signatures (yet may do wildly different things), so the benefit is somewhat limited.
You can’t put an API on everything because it’d take a ton of time and money to pull that off.

I can’t think of any technological reasons why every digital system can’t have an API (barring security concerns, as those would need to be case by case)

So instead, we put 100s of billions of dollars into statistical models hoping they could do it for us.

It’s kind of backwards.
> You can send lots of requests to a server and you have to tag them so you can match them up with responses later

Yes, you can match the final OK/NO/BAD responses with the original command based on the tag. The annoying thing is that each command typically sends most of its data in "untagged responses". And IMAP servers can send unsolicited untagged responses at any time too. It's quite tricky to handle all those responses correctly in email clients. Indeed, normally you just want to send a command, and get all the data for that command back until the finishing response. IMAP clients typically open multiple connections to isolate commands.
It’s a reasonable assumption. If two solar masses collide, their masses tend to combine[^]. Just “look” at planets that smash into each other. Ergo, a more massive black hole.

[^]: Ignoring ejections. But black holes also don’t “eject” mass. Or maybe they do? Hawking Radiation is weird.
I try never to mess with my stack unless something breaks so badly that changing it is necessary. This hasn't happened yet in... six years, for my current server? This is the first time I've had a "home server" that's more value than the cost of maintaining it, and frankly it's because I neglect the hell out of it and resist any urge to go make things "better" just-because. And because of the isolation of Docker images from the awful mixed-together system-and-userspace distro package manager—I can upgrade any daemon I care about with a tiny edit to a shell script and a couple commands, works every time, never fucks up my base system or other unrelated daemons due to any stupid crap like sometimes happens when you try to get newer packages on an older version of a Linux distro.

Docker's just a package manager and process manager, the way I use it, and has performed flawlessly in that role.
The craziest part is that it executes on my iPhone SE 2020 in Safari. Textures work, shading works, pretty insane. I even managed to break a block.
I don't know, but those situations exist and they might be more problematic than baseball is willing to admit. The pitcher may get more from the Yankees than the Brewers. So the pitcher may have more incentive to make sure the Yankees don't go bankrupt. Hmmm.
Thanks for the clarification. https://www.reddit.com/r/baseball/comments/1freiuv/recalling... this April fool’s video will give fun nostalgia. I guess the most accurate thing to say is that MLB at least thought about it for a second, long enough to get Jose Canseco to pretend it was happening.
> When’s the last time Microsoft fought the FBI for access to a surface device ?

Any company that has designed their security well doesn't have to fight the FBI because they have no data to give them. Apple's iCloud copies encryption keys for your data, giving Apple a backup decryption key that they can very easily give to any fed (and likely do already in FIVE-EYES/Chinese jurisdictions).

Private technology isn't dictated by relativism or dialectics. Treating your security like this is simply how you get hacked - I wouldn't trust Bitlocker or iCloud to protect my data because both are objectively backdoored. It doesn't matter how many San Bernadino publicity stunts the parent company arranges, you would look like a moron using this same line of logic to defend Microsoft or Google.
Cuneiforms: New digital tool for translating ancient texts
I’m curious why Hittite was the first choice of cuneiform language for this tool.
I think this really comes down to personal preference. I also use Firefox on Linux and always find the Windows-type scrollbar to be incredibly ugly and bulky, especially on other overflow: scroll elements.
they likely aren't under an obligation to tell investors about it immediately and simply putting something in their quarterly report about it will probably be fine.

That being said if they put something in some communication that said "we take security seriously" or something that would probably be grounds to sue as this obviously shows they aren't serious or something. The barriers to shareholder lawsuits for securities fraud are pretty low.
When smartphones became a thing a whole new requirement for web responsiveness was born. I wonder about a third kind: webpages that “paginate” rather than scroll.

I love the idea of eInk. Most of the good things I do on my phone would be improved with it, and most of the time killers would be discouraged. But I’m not sure I could handle the scrolling.
yes effects of big exogenous shocks are famously limited to exactly presidential term boundaries.
No Blinking: How to Disable Blinking Cursors
Intent to Prototype: FedCM support for phone number and username
> I'm not sure what it would take for the older and wealthier folks on here to open their eyes.

I think there are plenty of wealthy folks who understand the benfits of living in a more equal society, and that would gladly pay their fair share to live in such a society. The problem is they are not enough, and worse yet the middle class and what remains of the working class are actively pushing propaganda that goes directly against their own interests (perhaps because they think that one day they will too be millionaires).
I'm old enough to remember having to talk to a (human) agent in order to book flights, and can confirm that in my experience, the modern flight booking website is an order of magnitude better UX than talking to someone about your travel plans.
I believe clang and gcc avoid reading in and re-processing include files that are already included, so his advice is unnecessary and creates a lot of maintenance burden, especially for C++ where a lot more code is in header files. It may still be useful for old compilers, though.
Do you have a source for this poll you've referenced? The latest yougov poll i can find (from 2023) has significantly different results -- more under 50s responded don't know about immigration levels versus a skew towards too high in the 50+ population.

https://d3nkl3psvxxpe9.cloudfront.net/documents/Internal_Imm...

if the numbers have shifted over time, that's fine. but your 'latest poll' could be a daily mail phone in for all i know.
while getc != EOF really? You stat the file for its size, then alloc the buffer with that size and fread into that. Or fseek the end and get the size via ftell and fseek to the front
Except "uncle that works at Nintendo" is a meme because Nintendo of America is a small business doesn't develop almost anything, whereas "friend that works at Apple" is less unreasonable for an American tech worker forum to purport.
A big question here, do you think it would be possible to self-study optics and what would it take?
> Seriously if I can't trust that I am going to actually be told and not lied too when there is a security incident at the bare minimum, why would I chose to work with a company? What is Oracle's end goal here?

I think you're coming at this from the wrong point of view. Oracle couldn't care in the slightest about what regular people think of them. Remember, they are the company that sent lawyers after the employers of folks who downloaded non-free but bundled by default extensions to VirtualBox, and the company that declared that you need to license every core their software could _potentially_ run on in your virtualisation estate (so if you have a 8 vCPU VM for some Oracle software, you need licenses for however many physical cores you have on your cluster). They've variously been described as a law firm with an engineering side business, and One Rich Asshole Called Larry Ellisson. Speaking of whom, he multiple times flat out lied on stage to make his shitty "cloud" nobody cares about seem relevant compared to AWS.

Nobody buys Oracle because they like them or their good reputation. You buy them because you have legacy stuff that depends on them and you have no choice (even Amazon took many years to get off Oracle databases, and they wrote a gloating success story one they were done with it because they were that happy to be rid of the leeches), or because your bosses' boss was convinced at a golf course they're getting a good deal. Or because their bandwidth is very cheap and you accept the risk of dealing with the devil incarnate with zero morals. (cf. Zoom).

Oracle is like Broadcom. Everyone hates their guts, everyone who worked there has a black mark on their CV. Yet they persist, continue leeching off companies too scared to make the jump elsewhere.
Yes that's how notch was able to distribute it while circumventing publishers. Very smart move at the time.
I am looking to fill the need for exactly this. Mind to share which device you got and which apps you use to read manga?
Yes, because home runs still are not that regular of an occurrence. So they're still "special".

But if they become a lot more commonplace, then the allure will depreciate over time.
> the need is to be able to provision access after the relationship is established

Could you go into more detail? At a base level interpretation, this is how it works already (you need a principal to provision access for...), but you presumably mean something more interesting?
Not related to this story at all.
If you're ever in Pullman, Washington, stop in at the WSU dairy store and get a few cans of Cougar Gold cheddar. Cheese in a can sounds weird, but it's delicious, made by the students, and it ages really well -- I've got some cans in my fridge which are coming up on a decade old now. It's kind of a waste to use an aged can for mac and cheese, but I used part of a younger can for mac & cheese and it came out beautifully.
Somewhat on the similar track - Blender and Unreal Engine for games and cinematics, as a hobby.
It's not. Rather it's that every observer in the universe is at the center of their own light cone.

The fact that we can not observe anything outside our light cone is well understood.
To me the reason it feels silly is because iCloud is a paid subscription service and I am constantly advertised it even when using something like Syncthing or Nextcloud to provide equivalent support.
We need browsers where the _user_ can specify their legal terms in the response headers. Let's make this two-sided.
People working in software product companies – Need your help
Hey everyone! I am working on a product (Can't tell to avoid bias) that focuses on product managers, designers, engineers and customer success. If you have few minutes that you can spare, do you guys mind filling up the survey? This would be really appreciated :)
Survey link : https://form.typeform.com/to/yqiLdJmF
hah, I sure do know where and when many of the legendary productions got released. besides - we (demogroup ancient pain) released two in 1996 and 1997. when were yours released to down-vote my actually very informed comment, for real?

the fx scene in 2025 is full throttle with a short-form single-effect pieces being released daily, and some of them are actually quite good. some people also release the code to them unlike what demoscene guys did back in the day, as it all was closed culture, albeit free.

my comment was really - if kids are incentivized to do genart for money, or to just share pieces of short-attention spam material, why do it for the classic fun of it of the demoscene?
New blood test checks for Alzheimer's and assesses progression, study
> Even serious discussion of Chinese soldiers in Canada or Mexico is clear casus belli and surefire way for those countries to be occupied. Chinese soldiers on the border is existential to US and when dealing with existential risks countries tend to put funny concepts such as UN charter or human rights aside.

Talk of the Chinese being invited in by Canada or Mexico is precisely as much of a casus belli as Ukraine saying "please let us join NATO so Russia won't invade us!". Canada already has reason to fear invasion regardless, as Trump keeps talking about annexing them.

It didn't work out well for Russia, which is currently experiencing in Ukraine much what the US itself experienced in Vietnam. Or indeed in Cuba (Bay of Pigs) the year before the nuclear missiles which were much closer to a real casus belli.
Sure, but suppose I run something that spews all over, say, my homebrew install. That's not "part of the OS", but it might as well be.

Can apfs snapshots roll that back? Probably? But that functionality isn't exposed to mere mortals (and certainly not on the startup volume).

If there's a way to do this:

1. make-some-kind-of-snapshot abc123

2. make some changes all over the place (I don't know where!) that i then want to revert

3. restore-to abc123

and at this point, the entire system is exactly, precisely, bit for bit how it was after step 1 -- and where step 3 takes just a few seconds -- well, I'd love to know about it.
> Human made global warming is a first time

Human-made global warming appears to go back to the advent of agriculture, though, so for all intents and purposes it has been a constant throughout the history of which we speak.
The Evolution of HTTPS Adoption in Firefox
Also note that Judge is a machine
Apple's Project Mulberry aims to 'clone' your GP by next year, reports suggest
I'm guessing nobody chooses to work with Oracle anymore for reasons or in situations that we would consider reasonable. It's probably either governments contracts, with or without corruption, companies already locked in, contracts made by executives that don't really understand technology, that sort of thing.
Trump's Science Policies Pose Long-Term Risk, Economists Warn
Stochastic Reservoir Computers
<input type="datetime-local"> with automatic ISO8601 timezone offsets would be awesome too!
Feeding them the docs makes a huge difference in my experience. The docs might be somewhere in the training set, but telling the LLM explicitly "Use these docs before anything else" solves a lot of problems the the LLM mixing up different versions of a library or confusing two different libraries with a similar API.
Floppy disks DO NOT BEND!

Oh yes they do.
My first thought is that there must be something very wrong about this. They have moved the skill of hitting from the player to the "skill" of the bat. I am surprised MLB allowed it. I don't see it too far different than corking the bat.
There’s not really any way to stop it, considering Apple’s apps need to make these calls.
I enjoy Peter Norvig's writing style—it's rich in detail and backed by solid statistics. I've also been following Andrej Karpathy for the past two years, and I have to say, his writing has become my top priority to read first.
Well OC was referring to mass layoffs.

That article seems to be about contracted copywriters.

If your whole job is writing “150-word descriptions” (the article’s words) for $60 an hour and the like, yeah LLMs got you beat.

But that’s a far cry from mass layoff territory.

Also, in that same article, he was rehired by a (granted, a single) client who didn’t like chatgpt. What is the rate of clients that dropped chatgpt?
Except they're not all in jail.
I have mixed feelings about FreeBSD. Some stuff is genuinely good: major/minor release branches, the best ZFS experience you can get OOB, actual man pages, overall a lot "cleaner" than most Linux distros.

OTOH when you compare it to e.g. OpenBSD (or in many instances, even Linux), it's an actual mess. The default install leaves you browsing thru the handbook to get simple things to work; it has three (three!) distinct firewalls; the split between /usr/local/etc and /etc constantly leaves you guessing where to find a particular config file; even the tiny things such as some default sysctl value being an XML snippet - actually, WTF?

The desktop story is also pretty bad. OpenBSD asks you during installation, whether you'd like to use X11 - and that's it. You boot to XDM, you get a basic window manager, things like volume buttons just work, all in the base system - no packages, no config files. You can install Gnome or XFCE from there, and rest assured you'll always have a working fallback. FreeBSD still feels like 90's Linux in that area. Regarding usability, both are behind Linux in things like connecting to Wifi networks, but in OpenBSD's case you just save a list of SSIDs/passwords in a text file, and the kernel does the rest for you.

The author is praising jails. I think it's nice that you can trace the lineage all the way back to 6.x, it sings a song of stability. You can also put each jail on a separate ZFS dataset to get snapshot/restore, cloning, etc. But I think it's still a poor middle ground between OpenBSD and OCI. OpenBSD keeps making steps (privsep, pledge, unveil) to provide isolation, while remaining conceptually simple for the developer and imposing no extra maintenance burden on the operator. Containers by design are declarative, separate the system image from state, etc - it's a wholly different concept for someone used to e.g. managing stateful jails or VMs, but it reinforces what already were good design principles.
I'm aware of that. Clarifying it only doubles down on digging the argument-by-definitions hole. I'm starting to get a sense that that's the only argument here.
> cannot cope with things going back to normal.

Interesting take on "normal" by Canadian physician Gabor Maté.

https://drgabormate.com/book/the-myth-of-normal/
> Two players used the bats

I'm not convinced how much of the offensive onslaught was due to the bats either, but all of the sources I've heard/read have indicated that 5 players in the Yankees starting lineup have been using the bats:

https://apnews.com/article/torpedo-bats-yankees-6ac6c797ea93...

https://sports.yahoo.com/mlb/article/which-mlb-players-are-u...
Try asking it to generate a high-level plan of how it's going to do the conversion first, then to generate function definitions for the new functions, then have it generate tests for the new functions, then actually write them, while giving it the output of the tests.

It's not like people just one-shot a whole module of code, why would LLMs?
Your quoted sentence is an example of a group of people who have no idea of how to run a country. They are using the uneducated voter to support an agenda that is mostly unconstitutional. We Americans, just like other countries with a rule of law, determine our own culture within those laws.

To use federal power to reshape our culture is both arrogant and, since Project 2025 is how they want to do the reshaping, is against the New Testament principle of "live and let live". (another way to state this principle is: "Christian, mind your own business and stay in your lane.")
Recent reasoning research: GRPO tweaks, base model RL and data curation
I don't think anything "studied" there addresses my point.
Of course it has fundamental problems. Likely they are more prevalent then in other techniques, regarding LLM training or otherwise.

But one also needs to acknowledge how immensely useful and powerful the resulting models have become, achieving results pure supervised fine-tuning could likely not have achieved at all. Whether fundamental alignment of pre-trained models is even possible is a very different question.
I'd almost forgotten what it's like for a blog post to embrace that it's a short story and not drone on for pages to pad it out.
I would expect that only authorized users can access authenticated data and that we don't blindly assume a foreign server is 110% trustworthy at all times.

Maybe instead of just propagating authenticated cleartext data to unknown servers, users should get that data directly from the authenticating server?

We replicate public posts to reduce server load. Your server can rebroadcast my message to your 10k users instead of my server handling those 10k requests. But doing this for private data you need to be logged in to access is unnecessary and dumb. I have a perfectly fine server that is trustworthy. I want to send some private data to a single individual. So obviously I send that data off in plaintext to some random third server which I must assume is as trustworthy as my server so it can relay that data to (hopefully) only the recipient.

I expect that if I send private data to one user, it goes to that user and no one else. The fact that the only thing stopping a foreign server from publicly posting my private data for everyone is a "please don't" flag on the packet. Does this sound like a well designed and robust protocol?