alanning

Fun project, but I also really liked the way she came up with it:

I was doing a little creative exercise the other day around the word "Overgrowth”…

Is this a common thing in the creative space? Seems like a fun activity

Is the intended use to improve automation by agents during verification? To make it easier to drive Godot apps during e2e tests, for example?

I think the most interesting part of this story is actually the Playwright-style “driver” that they built into their new apps to support faster verification by the agents.

Hopefully they will write more about that in the future.

Not sure if they edited the article after you read it but this is the 3rd paragraph now:

“Taking antiviral tablets for 8 to 12 weeks can cure more than 95% of cases.”

Node v22.7.0 added support for TypeScript syntax that requires transformation:

`node --experimental-transform-types example.ts`

As for whether this matches your definition of "native support" or not...

Source: https://nodejs.org/en/blog/release/v22.7.0

Off-topic but is there an effort to test AI models against code versions with major historic bugs (Heartbleed, GHOST, log4j, etc)? Seems like the kind of thing that would be relevant in security-related AI benchmarks.

For those looking for help with SOC2 compliance, I had a good experience with another YC company, Vanta. That was some years ago so not sure if anything has changed since then but I would recommend checking them out.

This is a great example for educating devs on the dangers of “set” operations vs. “pull/delete” in contexts where data can be edited concurrently.

I would say that the audit log was accurate, though, even though the bad UI design caused unintended consequences.

One tool I've found useful in low-power/low-bandwidth situations is the Lynx web browser [1]. Used to be installed by default in most Linux distributions but I think that's probably not the case anymore. Wikipedia says its also available on OSX and Windows.

https://en.wikipedia.org/wiki/Lynx_(web_browser)

The Temporal Cookbook on TC39's site provides examples of how using the new API looks/feels:

https://tc39.es/proposal-temporal/docs/cookbook.html

For example, calc days until a future date: https://tc39.es/proposal-temporal/docs/cookbook.html#how-man...

...or, compare meeting times across timezones: https://tc39.es/proposal-temporal/docs/cookbook.html#book-a-...

I appreciate the time and effort they put into writing that. Interesting to see not only their own art but also the examples from other artists.

Any recommendations for getting exposure to other on-the-way-to-being-popular artists like the X-Ray one that was highlighted?

My wife and I got a kick out of your “Games at Dave's house” example. Thanks for sharing

Thank you for sharing this.

Regarding feedback on whether sandboxing would be useful, yes, please! Including something like Docker sandboxes would make isolating the agent env’s much less of a hassle.

As an aside, I’m curious how others are handling this now… Mostly just creating dedicated user accounts?

Google’s efforts there seem laudable. They have an internal db for tracking issues that employees identify, resolve them promptly (according to the notes in the db and their response to the article authors), and generally seem to be taking the issues reported seriously.

I have more trust for google after reading that, which is not what I expected

That is incredible

I didn't know what you were referring to since I use FF with NoScript. Enabled javascript for the domain and whoa, that is really hard to read. Very strange choice, the article is much easier to read with the default browser fonts. So I guess javascript-blockers FTW?

Which extensions would you recommend for this?

For those new to bitshifting, here are the results of the "stuff" operation that @dahfizz describes:

  'a' - 'a' = 0, so take 1 and shift it left 0 times:
  00000000000000000000000000000001 = 'a'

  'b' - 'a' = 1, so take 1 and shift it left 1 time:
  00000000000000000000000000000010 = 'b'

  'c' - 'a' = 2, so take 1 and shift it left 2 times:
  00000000000000000000000000000100 = 'c'

(I'm not sure why the post's author chose to use 10000000000000000000000000000000 as their example for 'a' rather than the above which IIUC is how the code actually works.)

One of the commenters on the blog post stated that the bypass did not work on their Samsung device.

“Modern mariners can tack against the wind by setting the sails at sharp angles. That wasn’t feasible 2,400 years ago because sails were fixed then.”

From the picture it seems the sail on the replica can pivot around the mast but looks like it would take a lot of work (and time) with all the rigging.

So is this quote’s meaning that modern sailboats can change the angle of its sail fast enough to be useful while the ancient ones couldn’t?

Yes, that was one of the issues they mentioned in the post. Not that they didn’t have a staging/testing environment but that it didn’t include the specific type of new architecture configuration, “MCP”, that ultimately failed.

One of their future changes is to include MCPs in their testing environments.

We are seeing errors related to DNS when our lambda services in us-east-1 and us-west-2 try to query SQS. Downdetector reporting more than 1000 user reports in last 15 minutes.

Just wanted to add my recommendation for checking into Davidson as well.

They offered a summer academy that hopefully will start back up again after covid and also have an online program that may be a good alternative to full home-schooling if you were considering going that route.

Update: Beast Academy is wonderful. AOPS is great too. Both very good suggestions. Your daughter may also like the math content produced by Poh Shen Loh [1].

1. https://www.poshenloh.com/

Ah, the code example doesn't work. User ptx clarified in a separate comment that the author meant it as just psuedo-code; it's value will be different in the next function invocation: https://news.ycombinator.com/item?id=28969530

Yes, my feelings exactly. :-)

Any idea how useState accomplishes the mutation of the n-1 element mechanically? Seems to violate the by-value and by-reference rules in my mental model of how javascript works.

I was originally guessing it was a syntax trick of destructuring where it’s actually calling some kind of property accessor behind the scenes even if you don’t type the parentheses. But the article says this also works so now I don’t know…

  const loadingTuple = React.useState(true)
  const loading = loadingTuple[0]
  const setLoading = loadingTuple[1]

  loading // true
  setLoading(false)
  loading // false

(Edited to fix code formatting)

To help clarify for purposes of continuing the discussion the original research did address the issue of minimizing the time of the reviewers [1] [2]. Seems the maintainers were OK with that as no actions were taken other than an implied request to stop that kind of research.

Now a different researcher from UMN, Aditya Pakki, has submitted a patch which contains bugs that seems to be attempting to do the same type of pen testing although the PhD student denied it.

1. Section IV.A of the paper, as pointed out by user MzxgckZtNqX5i in this comment: https://news.ycombinator.com/item?id=26890872

> Honoring maintainer efforts. The OSS communities are understaffed, and maintainers are mainly volunteers. We respect OSS volunteers and honor their efforts. Unfortunately, this experiment will take certain time of maintainers in reviewing the patches. To minimize the efforts, (1) we make the minor patches as simple as possible (all of the three patches are less than 5 lines of code changes); (2) we find three real minor issues (i.e., missing an error message, a memory leak, and a refcount bug), and our patches will ultimately contribute to fixing them.

2. Clarifications on the “hypocrite commit” work (FAQ)

https://www-users.cs.umn.edu/~kjlu/papers/clarifications-hc....

"* Does this project waste certain efforts of maintainers? Unfortunately, yes. We would like to sincerely apologize to the maintainers involved in the corresponding patch review process; this work indeed wasted their precious time. We had carefully considered this issue, but could not figure out a better solution in this study. However, to minimize the wasted time, (1) we made the minor patches as simple as possible (all of the three patches are less than 5 lines of code changes); (2) we tried hard to find three real bugs, and the patches ultimately contributed to fixing them."

Should be noted that NIST’s current recommendations are meant to be part of a number of mitigation’s including checking passwords against known-breach databases, rate-limiting, etc.

Without those other mitigations, pw rotation may still help more than it hinders, although I am definitely not a fan of it and recommend implementing all of the NIST’s recs instead.

For those looking to head that route, haveibeenpwned offers an API to check hashes against previous breaches. For a pw strength meter, have a look at zxcvbn.

Vertical-alternating seems very clear to me. Also consider allowing vertical-alternating to “compact“. Reducing blank space may be of value for some designs.

Do you happen to have a library/tool you could recommend that helps with this or did you develop something in-house?

My startup is implementing most of the NIST rec’s with the help of projects like zxcvbn but we would like to also start doing breach list comparisons so figured I’d ask.

The end of the article sums up the repossessors' argument quite nicely:

“If you take all the BS that they’ve thrown out, and you take our BS, and you take it down, it’s a very simple concept,” Heinkel says. “They have taken their stuff and placed it on someone else’s property without permission.”

“Now that’s them, and here’s us. We’re two guys who went to the property owners and got permission with that property owner to remove that stuff off their property. That’s all it is.”