harshreality
For Ubuntu (which I don't use), you'd need a 3rd party updated kernel repo, to use a patched kernel from that.
It's not an instantaneous exploit, it takes a lot of iteration over the network. A lot of cloud network providers are mitigating it by dropping options at the border, but unless you test and confirm that, you should assume it's possible for a motivated-enough attacker to compromise your server.
I shouldn't have to read the spec to figure out that it's like an epub, but for music (aac, with optional flac and wav support) instead of html. Along with some extra metadata features that mimic the experience of cassette players.
I think the jarring alternative definition of "purpose" is an intentional mental hack: to break people out of orienting themselves around design intent, when processes often go out of alignment with that. It's easy for humans to fool themselves. Taking a dispassionate, empirical view when considering what a process is doing, or analyzing what its range of behaviors is, can illuminate many problems.
The steelman -against- what waymo did is:
Guns are generally legal, even in California. This is America, not the EU. Nobody was harmed, nobody was threatened. This is like calling the cops on someone open carrying because you don't like open carry.
That is what a lot of pro-2A libertarians would argue.
The steelman -pro- what waymo did is:
Private conveyance. Even though the occupants thought they were "alone", there was someone/something else present, which felt threatened (or thought the passengers represented a potential threat to others) and called police, as most cabbies or uber drivers probably would.
I don't think there's a right or wrong answer. This is a grey area, and I think it'll likely resolve in favor of waymo, and it won't really bother anyone except the staunch libertarians. If the gun hadn't been illegally possessed, likely nothing would've happened after the cops were called.
Visual inspection would normally catch situations like that, and then you might be able to figure out if it's okay with continuity checks and voltage checks with a multimeter on the relevant pints of the psu to see if those pins are different voltages... as long as the PSU powers the connector in the absence of load or sense pin signalling.
It's not really a VPN for piracy purposes unless it's a commercial, no-log VPN. Since when a VPN is used to move the point at which traffic enters the internet, the owner of the VPN exit will be held to account.
They can try to claim they were running a "private" VPN and gave random people (from reddit and discord) internet access through it. They can try to claim they don't keep logs. Meanwhile, for a facebook VP with suspected activity tied to facebook corporate, the rightsholder will subpoena every digital device in the person's home, depose all their family and close friends, subpoena their facebook email...
[1] From wikipedia, citing deepmind's paper: 4858 Elo vs 3739 Elo
Based on the youtube video, it looks like katago was only using 16 seconds per move, is that right? https://www.youtube.com/watch?v=-86zF4mTWOY
Is 20 seconds on that hardware really overkill and well into the diminishing-returns curve, as a top-level comment suggested, or is it plausible katago could have played better if given 40 seconds per move?
match details: https://gostonebase.com/blog/shin-jinseo-vs-katago-kishin-ma...
A better, perhaps the best, argument is that a worse bot mix might appear tomorrow, so anubis should be used as a runway for a better solution, and not as a solution in itself. If only everyone with a website had the desire (or AI tokens) to implement their own better solution. In some cases even desire or a lot of tokens isn't enough. I mean, you think kernel.org folks haven't put some serious thought into it? And yet, as HN argues about it, there's kernel.org running anubis at difficulty 5.
However, the refrain from naysayers isn't that there's too much enthusiasm. It's that anubis doesn't make sense as a theoretical barrier against bots. Who cares as long as it works empirically, even briefly? Are you suggesting people let their sites continue to be degraded or unusable until they find a better solution, even though PoW challenges can improve the situation today?
Not everyone has the luxury of writing their own web app designed to handle massive bot traffic at minimal cost, gutting functionality to meet that requirement if necessary.
I noticed a couple of weeks ago that 1-2 orders of magnitude more bots were getting past anubis challenges. However, it would be incorrect to conclude that it's doing nothing and now worthless aside from heating up visitors' cpus. If I turn it off, I see >2x bots.
The next salvo in the war of attrition will probably be when anubis switches to wasm hashx, which the author suggested, in previous HN threads, is on the roadmap.
If bots quickly adapt (Claude vibe-coded JIT wasm-to-native-transpiler for hashx challenge algorithms?), that may be the end of anubis and efforts like it. If they don't, I expect more HN threads with people complaining that such compiler efforts are possible and therefore PoW-gated sites are doing it wrong... even if those sites stay usable.
They knew what was going on before they found the laptop. They had been briefed by someone at MIT who was in contact with JSTOR. I suspect that everyone on the networking staff (and possibly most of the university) knew of the JSTOR downloading situation after the second incident in October. JSTOR had blocked MIT for 3 days, and that must have caught people's attention.
Once they found the laptop, they involved police despite knowing to a virtual certainty that the problem with the laptop was that it was scraping JSTOR, again. They didn't know yet that it was Aaron, but they would've known it would turn out to be someone ideologically just like him.
There was nothing suspicious about it. It was simply jeopardizing MIT's contract with JSTOR. The use of a data closet like that was very bad manners.
The expectation is that such individual and laptop doing "unauthorized" scraping doesn't trigger a criminal investigation when the host university, and the target business, didn't implement any meaningful access controls or even rate limiting for any other person on campus.
The expectation is that after an investigation of scraping at 11 req/s (450,000 over 11 hours according to the report), a further 8,000 requests (before JSTOR blocked MIT's /8) two weeks later would not have the effect that "Half the servers in one data center failed, and JSTOR engineers feared that the entire service might go down worldwide." The expectation based on that claim by JSTOR is that JSTOR was incompetent or lying.
The expectation is that when MIT was able and willing to implement access control for JSTOR, and JSTOR declined because they want to develop a notice to MIT visitors who might be negatively affected by ending uncredentialed access, JSTOR would not then create a tempest in a teapot over the violator returning and continuing to download papers at a reduced speed that wasn't even detected for about a month. On Dec 26, when JSTOR again noticed the "abuse", they went to significant effort to route the violator's requests to a special server and serve them garbage instead of the real PDFs, all on short notice... yet they couldn't add the general notice to MIT visitors about the credentials requirement, on a much less urgent timescale; they had told MIT in October that they needed until after Dec 18th to add such a message. The expectation is that JSTOR's claims are self-serving lies.
The expectation is that such a request pattern would not trigger a report, by the MIT libraries director, to the MIT academic council, that a "cyberattack" had been launched from MIT's network.
The expectation is that you don't get arrested for felony B&E for entering a data closet that's effectively unlocked, connecting to a switch, and scraping a paper hosting site that offers free downloads from the entire institutional network.
The expectation is that you don't get charged with larceny for downloading, in any quantity, papers that are freely available to anyone on the MIT campus or probably most other campuses in the U.S.
The expectation is that sending web requests with a url parameter indicating T&C has been agreed to, and without saving cookies, might be a basis for a civil action, but is not "accessing a computer without authorization" under the CFAA.
The entire situation, at most, should've been a minor local crime and a lawsuit by JSTOR against Swartz. Yet the state charges were dropped (feds didn't want to share required discovery material), and JSTOR settled with Swartz before the feds even indicted.
MIT was caught in an awkward position of having the ability to block unauthenticated scraping to protect their contract with and access to JSTOR, but not doing so. So they proceeded to treat someone connecting to a switch in a data closet and doing what any MIT visitor could do, as a criminal offense.
I don't believe anyone at MIT was genuinely concerned that there was some broader criminal conspiracy when the issue was downloading of papers from JSTOR. Certainly not based on some random Chinese IP pinging or scanning Swartz's laptop. When the data closet laptop was discovered in January, MIT could have left a note telling the owner that JSTOR is very upset and it would be better for everyone if the scraping stopped. Why didn't they? They could even, reasonably, have taken the laptop and external drive and noted that the data closet was insecure and please contact network staff to claim it.
You're probably referencing https://english.stackexchange.com/questions/137551/bald-face... — but see in particular the "Update" section of the top answer.
Modern references seem to align (for instance, Garner's): Bald-faced and bare-faced have slightly different connotation than bold-faced. Despite "bold-faced lie" being in somewhat common use, "bald-faced lie" is more common (over 2x according to google stats), and overwhelmingly agreed upon as the "literate" choice, unless an author intends to refer to the sort of lie that would headline an article.
I don't think anyone complained about the hologram or red moon desert background because they disliked windows; they complained because they were hypersensitive to possible inappropriate/sexual connotations in imagery.
(Conversely, I very much doubt that the baby hologram or the red moon desert background swayed anyone to dislike Windows.)
People who hated Windows for being Windows would complain about it on technical grounds. It was terrible, and it crashed all the time. People who hated Windows because it was by Microsoft, would complain about Microsoft's bundling and monopoly tactics.
If cage or server access was shared between Iron Mountain customers, how can Iron Mountain not have a record of what's in what cage or what's on what server?
If Iron Mountain customers like OSS were free to add or remove things without Iron Mountain's knowledge, then their (OSS's) access would've been limited to cages or servers dedicated to their (OSS's) own clients' data. Allowing an OSS ex-employee the same access they previously would've had should be a non-issue, from Iron Mountain's perspective.
Suppose it's not superintelligent, whatever that means. It's still hopping from cluster to cluster, doing who knows what in its game-of-telephone prompt chain. What prevents a crisis where world leaders have to declare martial law and shut down all accelerated clusters, and hope that such a rogue frontier model hasn't hopped to a sufficiently capable private cluster with sufficiently inadequate oversight?
AI companies are also working to integrate training with real-world experience through sensors and robotics, to shrink the gap between human experience and hallucinated LLM experience.
They all have archives of pre-LLM content. There's also archive.org, google books, and pirate ebook archives. I don't know what they're doing to build video and audio archives, but judging from the cost of spinning rust, they're storing significant quantities of that, too.
Some parts of the internet are curated, and even with LLM influence they're still worth training on. I doubt wikipedia or stackexchange or rosettacode will ever cease to be useful at all.
Real programming means writing your own javascript glue, pulling in hundreds of supply-chain-compromised js libraries that you never inspect or profile, and running the whole thing in a browser engine, while making sure to store all state in the cloud.
The modern breed of programmers who don't understand programming have switched from C and C++ to Rust and Go, so they're on the right track of using more resources to improve the developer and user experience, but they haven't gone nearly far enough. They still do dumb things like write efficient code, and profile and put effort into reducing binary and resident size. They should trust in javascript and the browser and the internet, like all good programmers do.
Zig programmers have completely lost the plot. They're of the type that tries to write "hello, world" manually rather than pulling in a third party library so they can efficiently call helloWorld(). Writing single-binary apps that fit on a floppy? Who even cares? What even is a floppy? How do they call themselves programmers without css and advertising telemetry?
For a webapp that sets a long-lived cookie, that cookie could be used to bypass anubis completely, or lower the weight in anubis so that it doesn't send its pow challenge unless there are major red flags. If bots start to abuse that exception, it can be removed.
In addition, nothing prevents anubis from sending a wasm solver instead of js, reducing the gap between a custom native solver and a js solver.
While dedicated scrapers/attackers could work around it, and they could do so much more efficiently than the client-side js, almost none of them do. Unless you like paying additional hosting resource fees to serve bots, it's a worthwhile option, and is less annoying to typical human visitors than cloudflare's interactive captcha/challenge which is what most people use.
The main author is aware that the algorithm is far from ideal for this purpose. See https://news.ycombinator.com/item?id=48869064 . If more bots start to answer the primitive challenge anubis uses now, that'll hasten implementation of a different algorithm.
Don't let the perfect be the enemy of the good enough. For now, the algorithm or challenge scheme almost doesn't matter. Since it's much smaller-scale than cloudflare's challenges, that's probably why very few scrapers and botnets bother to solve anubis's trivial sha2 pow.
Targeted attacks may not be repelled at all. That's not the point.
Instead, the pilots saw the airport visually and requested a visual approach. ATC cleared them, and told the military they could resume GPS jamming, meaning any terrain awareness warning system the pilots might have had or been relying on would no longer work. The visual approach involved a left turn and descending directly over the mountains.
blancolirio's video about this (second one, after the prelim investigation report): https://www.youtube.com/watch?v=Dcyup4xVQuM
He focuses on the fact that both instrument approaches were impossible under the conditions; gps jamming made RNAV impossible, and an inoperable weather broadcasting system at the destination made ILS impossible. The alternative, visual approach in mountainous terrain on a moonless night, is clearly unwise for inexperienced pilots.
One thing he doesn't mention, though, is that ATC could have waited until the plane was on the ground to tell the military they could resume GPS jamming, knowing this was a medevac flight lacking the usual planning and level of caution of typical pilots.