plg94

some people just don't have a good memory for acronyms. It's one thing to learn the concept of a privilege escalation, but an entirely different thing to play mental memory with TLAs (three letter acronyms). Acronyms remove all the context from a term which makes them way harder to memorize. A bit like knowing your friends vs knowing their phone numbers.

Understanding a term with the help of context is very different from guessing what the letters of an acronym might mean. The latter is more like a crosswords puzzle, and a totally unneccessary task for the reader.

> Why isn't it the job of the distros to keep up on upstream security disclosures?

They can't, because (responsible) security disclosures are private, _not public_. That's the whole point of the system: notify the developers in private ahead of time (usually 30, 60 or 90 days) so they can write, test and roll-out the fixes before you release the info to the whole world. This is to minimize the time between when bad actors gain access to the exploits vs. when users install the patch. So "keeping up on security disclosures" cannot ever be a 'pull' process.

Usually the maintainers of the big distros are part of (private) security mailinglists and receive such info. Just not in this case it seems.

> considered classics

Great games, but all you listed are barely 3 years old – can something that young already be considered a "classic"?

https://en.wikipedia.org/wiki/Seagull_management : come in, make a lot of noise, shit everywhere, leave

The headstone (https://de.wikipedia.org/wiki/Carl_Friedrich_Gau%C3%9F#/medi...) does not (it does feature the star of David, but I couldn't find any notion that Gauß was jewish).

But there's a statue with that star (https://de.wikipedia.org/wiki/Carl_Friedrich_Gau%C3%9F#/medi...)

For 17, Gauss noticed that cos(360°/17) can be written only with elementary operations, see https://www.heise.de/imgs/18/2/1/2/3/3/6/4/siebzehneck-b95b5...

Later he proved that all n-gons with $n=2^k*p_1…*p_r$ where the p_i are Fermat-primes (2^(2^m)+1 prime, today we only know of 3, 5, 17, 257, 65537) are constructible. The opposite direction, i.e. all other n are not constructible, was only a few years later proved. Look up "Theorem of Gauss-Wantzel". I only skimmed the proof, but it seems to generalize the concept of constructing the cos of the angle with "Galois-Theory".

(edit: or see https://en.wikipedia.org/wiki/Constructible_polygon)

I believe if things get too heated, all the parties involved should be forced to meet in person for a weekend to talk things out. I'm sure it would solve like 90% of these stupid conflicts, because people rarely get _that_ riled up when in the same room. Written communication, especially asynchronus ones like email or forums, are just unsuitable to capture all nuances of human behaviour. Someone is tired or hungry and makes a bad joke; next thing you know there's a witchhunt…

(I also don't think they should be allowed to cite things said 5 years ago as a reason to ban someone today. How could that still be relevant?)

You did have any opportunity to rewrite your sentence to use any other word than f**, one that did not require self-censoring. Yet you did not. Why?

I don't have a factual answer for you (be interested in one, too), only a cheek-in-tongue one: It's like politics, the only thing you have to do to get elected is to get people to vote for you. And often the vote is only among people who _want_ to be elected (and in a position of power), massively reducing the pool of good candidates.

wow, you made hackernews turn into tumblr. Well done, great explanation.

Maybe. That drugstore chain mainly sells hygiene products. Their "main" side-business is printing photos, both digital and on film. (Yes, even in 2024 in Germany it's still possible to hand in your film in a small drugstore and have the photos developed and ready for pick-up a week later.) So I guess printing on normal paper is just a side-side business that developed naturally.

Anyway, the 10c/page (A4 b/w) is still a good estimate, at least when I looked pre-pandemic (it might've increased slightly to 12 or 15c by now). A lot of cities, especially those with a University, have dedicated small "Copyshops" where you can walk in and get your 100+ pages thesis printed and bound within 20min. So the prices and service are aimed mostly at Students. It's true colored pages are significantly more expensive than b/w, but overall that's still cheaper.

why over 8k??? The linked [dmca notice](https://github.com/github/dmca/blob/master/2024/04/2024-04-2...) lists exactly 12 repos, not 8000. Where did they get this info from?

edit: ah, the number of 8,535 is in the beginning of the notice itself, but due to the large number they did not list all of the forks, I guess the listed ones are the only non-forked repos.

That doesn't matter, in most jurisdictions stealing trash is still stealing. If I'm disposing chemical waste in your backyard, do you automatically become the owner?

Yes, for big parts where they know it will come down to the surface they try to aim for water, like they do with all the rocket boosters etc. However that's still risky, so given the choice between (fast descent and aim for ocean) and (slow descent to burn up in atmosphere) they almost always aim for the latter. Plus you can only "aim" something like a rocket booster or a satellite that can still generate a little thrust of its own. This case was more like throwing your heavy backpack from the top of a skyscraper – 3 years ago(!!). That's impossible to control. Plus it has been an emergency solution anyway, see https://www.space.com/space-station-jettisons-huge-space-jun...

But are you allowed to sell it? I'd think it still belongs to NASA. If an airplane flies over your house and drops an engine into your back yard, you can't just auction it off but have to hand it over to the authorities. Or if someone – accidentally or not – throws his Rolex watch into your window. He'll have to pay for the damage, but the object is still his property.

I was given [1,2] in the second run. Even easier to see it's impossible.

that was the whole reason this was caught this early, because Andres Freund was runnig Debian Testing (or Unstable)

One of the problems with the "money solution" in this case is that xz is a very small, relatively stable software. Sure things like the linux kernel, firefox, gnome or openssh could use huge donations to fund multiple developer day jobs for years. But xz is small, it doesn't need to add a lot of new features constantly. It does need maintenance, but probably only like a couple hours each month – surely not enough to warrant a full-time day job. So what does the dev do to spend the other 90% of his time (and earn the other 90% of the money)? Some people don't like juggling multiple jobs (very stressy), some corporate jobs don't allow it, plus you've done nothing to reduce the Bus-factor (ideally any vital library should have 2,3,… people working on it, but who can take of just 5% of his day job to devote to open source maintenance?)

You do realize that "that shit" was part of the obfuscated and xz-compressed backdoor hidden as binary test file, right? It was never committed in plain sight. You can go to https://git.tukaani.org/xz.git and look at the commits yourself – while the commits of the attacker are not prime examples of "good commits", they don't have glaringly obvious red flags either. This backdoor was very sophisticated and well-hidden, so your comment misses the point completely.

the bad actor was a co-maintainer of the repo (and even more active than the original maintainer for quite some time) with full commit rights. This was strait committed to master, no PR and no review required.

edit: also this was heavily obfuscated in some binary files that were marked as test files ("good" and "bad" xz compressed test file). No way to spot this if you don't know what you're looking for.

No. From what I've read on the openwall and lkml mailing lists (so generally people who know a lot more about these things than I do), nobody accused Lasse Collins, the original maintainer, of being involved in this, at all, and there wasn't any notion of him becoming untrustworthy.

I don't think we know what exactly this does, yet. I can only answer one of those questions, as far as I understand the "unreplayable" part is refering to this:

> Apparently the backdoor reverts back to regular operation if the payload is malformed or *the signature from the attacker's key doesn't verify*.

emphasis mine, note the "signature of the attacker's key". So unless that key is leaked, or someone breaks the RSA algorithm (in which case we have far bigger problems), it's impossible for someone else (researcher or third-party) to exploit this backdoor.

Even on the screenshots on instagram in this very post the word "sexual" is censored. It's ridiculous.

This has nothing to do with AI, the anecdote is from 2018.

Not a good point.

A lot of that land is inhabited, or at least owned by citizens or companies. Pretty sure they would be against changing citizenship or losing their land.

And for government owned, uninhabited land: land is worth a lot more than its surface area. You can have natural resource of all kinds underneath – maybe some that are technically or financially not feasible to mine, yet, but may be in a few decades. (Just think of the massive oil fields in the arctic that'll soon be accessible to Canada and Russia) If it's a coastal area it massively extends your country's EEZ – that's why there are a lot of border conflicts around tiny rocks in the ocean. That's also the prime reason why Russia will forever hang onto Sakhalin island. (Plus Japan already is not doing much with Hokkaido, I doubt they'd do anything worthwhile on Sakhalin except forestery and military areas).

But zdeus is the 'owner' of the nitter project on Github. That's their official word for it, even though it doesn't necessarily have anything to do with the legal concept of (copyright) ownership.

And then there's 'owner' in the software dev sense, i.e. the one that ultimately decides which direction the project takes, what patches to merge etc. is sometimes referred to as "product owner".

you mean X'd on X

It depends how the self-checkout is executed. In our one supermarket here in Germany (Globus) each customer gets a mobile scanner unit and you scan each item as you go through the store and put it in your cart. This has multiple advantages: You only have to touch each item once, not three times. You always know the accurate total price – no more counting in your head. And the actual checkout process is just the payment (plus the occasional random spot check), so there's almost never any lines. All in all makes for a much quicker and more relaxed shopping experience.

Unfortunately I don't know any numbers re theft, but it's still running 5 years later. Of course being in a suburban area helps.

Some of these emails are legally required for online shops. Doesn't matter if the user wants to receive them or not, they _have to_ be sent and actually delivered to the user's inbox.