mkipper

I'm not at all familiar with the Xbox One, but this is a feature that's generally available if you're designing "closed" hardware like a console. Most SoC these days have some sort of security processor that runs in its own little sandbox and can monitor different things that suggest tampering (e.g. temperatures, rail voltages, discrete tamper I/O) and take a corrective action. That might be as simple as resetting the chip, but often you can do more dramatic things like wiping security keys.

But this exploit shows that it's still almost impossible to protect yourself from motivated attackers with local access. All of that security stuff needs to get initialized by code that the SoC vendor puts in ROM, and if there's an exploit in that, you're hooped.

Your chances of running into trouble are pretty close to zero unless you're wearing a 51st State t-shirt or something.

I work with a a decent number of Americans who either moved here or are here temporarily, and I can't say there has been any tension. I think most Canadians who are staunchly anti-US are also aware that plenty of Americans aren't happy with their government. I can't say I've seen any vitriol towards the average American person.

There's a pretty stark contrast between an MLB player making $50M per year and a bobsledder who's promised $100K 20 years after reaching the pinnacle of their sport. Given the total amount of training that an Olympian puts in over their life, even if that $100K is adjusted for inflation it probably works out to less than minimum wage in many states. That's a pretty bad profession IMO.

I'm not an expert here, but I this is pretty unlikely at this point.

Google has been working on Fuschia for a decade, and far as I can tell, the only place it was ever deployed was to a Google smart home hub 5 years ago. The only Fuschia news I've heard since then was about layoffs and killing projects related to it (e.g. Chrome on Fuschia).

If Google isn't moving any of their own phones over to Fuschia after a decade of work, it's hard to imagine them unilaterally flipping Android to it and forcing the hand of every Android OEM to follow suit.

Yeah, this immediately made me think of DAF.

My wife is a speech pathologist and hooked me up to a DAF machine for some research, and the effect was totally shocking to me as a layperson. I think I did worse than average, but I was basically unable to speak with delayed sidetone.

I think you're misunderstanding their point.

Your API is constrained by the actual TCP protocol. Even if the sender uses this message-oriented TCP API, the receiver can't make any guarantees that a packet they receive lines up with a message boundary, contains N messages, etc etc, due to how TCP actually works in the event of dropped packets and retransmissions. The receiver literally doesn't have the information needed to do that, and it's impossible for the receiver to reconstruct the original message sequence from the sender. You could probably re-implement TCP with retransmission behaviour that gives you what you're looking for, but that's not really TCP anymore.

This is part of the motivation for protocols like QUIC. Most people agree that some hybrid of TCP and UDP with stateful connections, guaranteed delivery and discrete messages is very useful. But no matter how much you fiddle with your code, neither TCP or UDP are going to give you this, which is why we end up with new protocols that add TCP-ish behaviour on top of UDP.

> but with the expectation that only openai has access to it

You can argue about "the expectation" of privacy all you want, but this is completely detached from reality. My assumption is that almost no third parties I share information with have magic immunity that prevents the information from being used in a legal action involving them.

Maybe my doctor? Maybe my lawyer? IANAL but I'm not even confident in those. If I text my friend saying their party last night was great and they're in court later and need to prove their whereabouts that night, I understand that my text is going to be used as evidence. That might be a private conversation, but it's not my data when I send it to someone else and give them permission to store it forever.

I haven't used it in a few years, but I always found it to be very flexible and useful for non-Qt projects.

I last used it for an embedded project, which are sometimes a pain to set up in an IDE (cross-compiler, sysroot, debug server, etc.), and I was shocked by how easy it was to get going and how smooth it felt compared to most IDEs.

This also stuck out to me, but in defense of Amazon (yuck), I don't see that language directly from anyone at Amazon. They use the regular "reduction in corporate workforce" BS that every big company on earth uses. It just seems like an editorial choice unless I'm missing something.

I work in software now, but I have an electrical engineering degree and started my career on a project developing a radio. Our project probably had ten or more electrical engineers on it, and only one or two of them really understood the RF side of it. It's a very specialized skill -- even EEs with >20 years of experience would describe things as black magic.

So I don't think you're alone feeling this way. Even with a good foundation in the theory and math, I think most people hit a wall with radios at some point. All the people I worked with who intuitively "got" RF stuff had been doing nothing else professionally for over a decade.

This is veering into pedantry, but from what I can understand of that setting (I'm not a sysadmin guy but have used MACsec on embedded stuff), that's just as much of an 802.1X feature as a MACsec feature.

Sure the switch will only accept encrypted L2 traffic...but that encrypted link is set up via MKA, which is a part of the 802.1X standard. If you don't have 802.1X authenticating the endpoint, you don't have MKA setting up the encrypted link between that endpoint and the switch and you don't have MACsec.

So if you're trying to prevent a bad guy from getting on your LAN, you need 802.1X, whereas MACsec is an optional extra (a very useful extra if you're worried about MITM attacks). But 802.1X is still doing the heavy lifting w.r.t access control.

Even if it's not some staggering triumph of human achievement, I'd argue that Ozempic (etc.) is similar. A magic weight loss drug has always captured the public's imagination, and it feels like I've been hearing about new weight loss drug studies in the news for my entire life that never went anywhere.

I think this is more relevant. Like everything, most games today are optimized to maximize engagement and keep people with low attention spans hooked. There are plenty of intelligent people who could invest a bunch of time into solving a puzzle but just don't care to.

I remember playing Myst as a not-particularly-bright grade schooler and banging my head against puzzles for weeks without making any progress. It wasn't some great intellectual challenge -- I was just bored and didn't have any other games to play. I can't imagine I would have stuck with it if I could have watched YouTube or played Fortnite instead.

I never looked into the guts of how this was implemented, but I worked on a product which had an SNMPv3 agent that was only restricted by a username and password. I could flash a PC with a fresh Ubuntu image, apt install Net-SNMP and start sending SNMPv3 requests without every futzing with any keys.

If I remember right, handling SNMPv3 traps required some messy key stuff so the agent still sent SNMPv2 traps, but there was no requirement for keys for GET/SET.

This isn't totally dead. I missed a flight last year and got bumped to a flight the next morning on some weird ticket class where I didn't get a seat assignment until the gate. The gate agent was able to give me a bulkhead seat with extra legroom at no cost. And this was with United, not some airline with a shining reputation for customer service.

So you can roll the dice and try to get a premium seat at the gate, but that's not a risk I'm usually willing to take.

I'm 6'6" and I basically treat an exit row upgrade as non-negotiable. It's just a fundamental cost of long haul travel for me if I can't swing premium economy or business class.

To get some extra legroom, I paid (round trip, in CAD) $250 for a trip to Dublin this year and $320 for a trip to Hong Kong in 2023. That's a lot of money, but it was <50% of the cost to upgrade to premium economy and <20% of the cost to upgrade to business class.

This used to be much cheaper. I remember paying ~$100 for similar upgrades a decade ago, but airlines got wise to this at some point and jacked the prices way up.

I don’t have any data to back this up, but I think window and aisle seats being more valuable doesn’t necessarily mean they can be sold for more.

I am very tall and I always pay for a seat with extra legroom in economy. Whenever I’m picking my seat early, almost every seat in economy is available. People could pay to reserve a window or aisle seat, but anecdotally it seems like almost no one does this. Everyone I know just tries to check in as early as possible so they can grab a good seat before they’re all taken.

I don’t think airlines are actually losing any money by seating families together. It’s not like all those window and aisle seats would have been paid for otherwise.

I applied for a management-consulting-ish job a decade ago (I was desperate!) at a big firm and had to take what was basically an IQ test. I have no idea if the test literally calculated my IQ, but the questions were exactly the questions you'd see in an IQ test (e.g. next item in some geometric sequence) so it may as well have.

This was in a group interview for recent university graduates at a very big company. I assume their hiring process was pretty standardized, so there were probably thousands of people taking this test every year in North America.

Was this professionally or in school? I still did this in an EE program 15 years ago and I can't imagine things have changed since then. I think kids still have to do lots of ugly math in EE classes.

If you're pulling the datasheet from the vendor website, you can also skim the list of documentation and see if there are any application notes available for the part.

For more "complicated" parts (e.g. lots of signals, high frequency, high power, etc.), integrating the part into a board design isn't necessarily straightforward. Rather than putting a ton of detail in the datasheet, the vendor will sometimes have an entirely separate document with design guidelines for the part.

This question is sorta similar to "Why don't distros enable restrictive MAC policies by default"

Maintainers _could_ take the time to lock down sshd and limit the damage it can do if exploited, but there are costs associated with that:

  1. Upfront development cost
  2. Maintenance cost from handling bug reports (lots of edge cases for users)
  3. Maintenance cost from keeping this aligned with upstream changes

You could extend this argument and say that distros shouldn't bother with _any_ security features, but part of the job of a distro maintainer is to strike a balance here, and similar to SELinux / AppArmor / whatever, most mainstream desktop distro maintainers probably don't think the juice is worth the squeeze.

I’m incredibly confident that any professor of aerospace engineering would give a better response. Is it common for people with PhDs to fall for basic misconceptions in their field?

This seems like a reasonable standard to hold GPT-5 to given the way it’s being marketed. Nobody would care if OpenAI compared it to an enthusiastic high school student with a few hours to poke around Google and come up with an answer.

That's what gets attention in the media, but the Trump administration has also been axing a lot of "traditional" programs.

I used to work a defense contractor and still have some friends in that industry. One of them told me their project (related to some armored vehicle) was unceremoniously killed overnight a few months ago. As best they can tell it had nothing to do with cost, schedule, missed deliveries, etc -- it was just someone in the administration deciding they don't want to keep paying for it. They work for a very large contractor and apparently this happened to a whole bunch of projects / teams there.

I guess "often" is relative, but this happens to me pretty regularly.

I live in Canada, and it's not always obvious if an American company ships here or not. If the answer isn't trivial to find, I'll do this:

  1. Add something to the cart
  2. Start the checkout process as a guest
  3. Fill in the boxes that pop up during the checkout process
  4. Close the tab when I see that the country dropdown only has USA available

On most websites these days, you're asked for your email before your mailing address. And after I abort the checkout, I'll get an annoying "Psst...you forgot something in your cart" email a few hours later even though I never made an account or placed an order with my email.

Stores built with Shopify do this so consistently that I have to assume it's an out-of-the-box feature you need to opt out of.

Is it so hard to believe that someone can be a great candidate in an interview when you're getting 100% of their attention and then be horrible at their job when you're getting 20% of it because they're juggling 5 jobs?

Generally speaking, provincial parties are either loosely affiliated or unaffiliated with federal parties which share a name. e.g. Alberta recently had an NDP government that skews much further right than the federal NDP.

If someone says "BC is Liberal" when discussing multiple provinces, they're probably referring to the distribution of federal MPs from BC. And in three of the last four elections including the most recent, the Liberals have "won" BC federally.

There are _some_ differences in quality, but I think they're pretty minor.

I recently visited the Philippines and a friend bought some knockoff Crocs at a market. The little rivet thing holding the strap to the shoe had the logo printed right on the exposed plastic, and after a few days, the logo was mostly scratched off. But my wife's Crocs that she bought a decade ago still look fine because there's some sort of sealant on top of the logo.

Is that worth an 800% markup? Probably not. But the knockoffs do cut some corners that the genuine articles don't.

This can be a pretty blurry line.

If the engineer took some existing product and did nothing for 2 years other than design in additional failures that show up after the warranty has expired, I agree that's awful. However, I'm very skeptical of that. I've worked in some manufacturing orgs who try to pinch every possible penny they can, and I've never seen anything resembling that level of mustache-twirling villainy in engineering. Also, 2 years seems like an incredibly long time for someone to spend doing this and nothing else.

It's much more likely that the company asked the engineer to reduce the cost of the pump while still hitting the product's requirements (e.g. no failures during warranty period plus some margin), and while doing that, the engineer found the design was overspeced for those requirements and made some changes which reduced the pump's expected lifespan while still meeting that requirement.

Unlike what the OP is suggesting, this happens constantly...it's what engineering is.

Obviously I'm not OP and I'm reading between the lines here, but it's very easy to imagine someone hearing this story second-hand and completely misrepresenting it.

Conveniently, there's no mention of the 0.1% in there, and the historical data comparing the tax contribution of the top 1% to the total tax base doesn't include any information on income and wealth growth of the 1% over that same time period. Weird!

But given that the organization who published that was founded by a Newsmax board member, I'm sure they're trying to paint a clear and unbiased picture of things.

And if you wrote this comment in December 2022, Bitcoin would be sitting at -70%.

I sincerely don't know anything about monetary policy, but I can't imagine that sort of volatility in the value of your currency is considered a good thing.