Hacker Newsnew | past | comments | ask | show | jobs | submit | gnomewascool's commentslogin

You can embed fonts into an HTML page. For example, place an @font-face with the src:url being a base64-encoded blob, in a style element.


I think part of the point of OP is that if your main concern is DRM (being able to actually own your books) and you also care to a non-zero extent about the author getting paid for their work (yes, authors receive a much smaller share of sale price than they should, but it's still a substantial percentage), then you should try to buy from DRM-free bookshops and only if that fails sail the high seas.

Regarding corporate piracy for AI, I don't think it's just Meta..


Sublime Text? (It's extendable in Python, but isn't FOSS, which might be a deal-breaker.)


I'm not quite sure what your exact specifications are, but I think that Celestia[0] fits?

[0] https://github.com/CelestiaProject/Celestia


> "YOUR RESPONSE MUST BE FEWER THAN 100 CHARACTERS OR YOU WILL DIE."

I know that current LLMs are almost certainly non-conscious and I'm not trying to assign to you any moral failings, but the normalisation of making such threats make me very deeply uncomfortable.


Yes, I’m slightly surprised that it makes me feel uncomfortable too. Is it because LLMs can mimic humans so closely? Do I fear how they would feel if they do gain consciousness at some point?


Because they behave as if they are sentient, to the point they actually react to threats. I also find these prompts uncomfortable. Yes the LLMs are not conscious, but would we behave differently if we suspected that they were? We have absolute power over them and we want the job done. It reminds me of the Lena short story.


I feel uncomfortable because of the words themselves. Whether it was made to a “regular” non-living thing wouldn’t change it.


> make me very deeply uncomfortable

Especially when thinking that we ourselves may very well be AIs in a simulation and our life events - the prompt to get an answer/behavior out of us.


Interesting slides! Thanks!

`pip download --no-deps` allowing arbitrary code-execution is non-obvious, and IMO broken.


Even pip install allowing arbitrary code-execution is non-obvious, although perhaps not entirely broken.


Does it matter if the code-execution happens at `pip install` or `python myapp.py`? Using 3rd party libraries inevitably means you're allowing code-execution to 3rd parties, that's the point after all.


Yes, because you could in theory run `pip install`, then manually read through every file you've just downloaded, then run `python myapp.py`.

But every package manager seems to grant RCE to every installed package. I agree it's broken.


> Yes, because you could in theory run `pip install`, then manually read through every file you've just downloaded, then run `python myapp.py`.

This security model is utter nonsense because no one does this.


Replace "manually read through every file" with "run your security code scanner against every file" and it becomes less nonsense, but just as applicable.

In reality this really isn't how code scans are done, so it's still a little silly, but I could theoretically see something like this being a desire.


It becomes more applicable, not just as applicable.


Amazon asked me to and I actually did it for all the Brazil third party imports...

granted it wasn't the most thorough of reviews, as is the nature with huge PRs


> then manually read through every file you've just downloaded

pip download?


Which can also execute arbitrary code according to the slides above.


You're not being imaginative enough.

Evil Joe: Can you install this package in the system's python install? All users in the lab need it.

Naive Joe: Hm... Seems harmless enough enough. Let me just install locally and check if there aren't any setuid binaries in there

naivjoe:~ $ pip install --local getpwned

... checks all installed binaries look good ...

Naive Joe: Funny package name

naivjoe:~ $ sudo pip install getpwned

Naive Joe: Done!

Evil Joe: Thanks! evil laugh

Naive Joe: uh what's so funny?

Evil Joe: Nothing.

Careless, amateurish? Maybe. Obvious? Maybe not.


Such a disc-renting business would be a competitor to Netflix, both directly (especially in the hands of somebody who tried to focus on it, rather than reluctantly maintaining it, as Netflix has been doing recently) or because it could eventually try to repeat Netflix's own pivot into streaming. Consequently, selling it off would be rather risky.

The start-up costs and need of name-recognition are probably sufficient that it'd be hard for a new company try to fill this niche, but if they bought Netflix's distribution network they could likely manage.


It's not 2000 anymore. This strategy can't be repeated anymore as it depends on the environment being the same as 20 years ago.


What the OP meant is that there are (multiple!) open source C compilers, which you agree is the case.

Questions about the standard/specification are a different matter:

1. Whether the language has one? (Many languages, both open source and proprietary don't! I believe mojo doesn't have one?)

2. Whether it's available for free (gratis)?

3. Whether it's under a free (libre) license that allows redistribution with modifications?


That's a very interesting comparison (thanks!), but I'm not sure if it's the correct framing. Making scraping technically difficult would be equivalent to trying to score a goal (so still not great, for the rest of the world, but probably not hypocritical).

Trying to prevent certain classes of behaviours via legal means is more like trying to prevent certain types of play, by appealing to the referee, while still doing them yourself. Clearly, this often does happen in sports, but _is_ generally seen as hypocritical.


For quite sometime I've always felt that "sports analogies" are overwhelmingly the BEST way to frame most microeconomic disputes. Much better than the far inferior Darwin-esque "Survival of the fittest" metaphors that imply some natural order to certain types of greed and bad behavior.

There's NOTHING natural about our economic systems. They're all COMPLETELY made up, let's treat them that way.

(and yes, here it is about 'lobbying the ref')


Sport in general is a cultural phenomenon and it seems that all cultural phenomena share a lot of similarities.

Genetics however is not only a useful model, it's hard science. You can experimentally find out whether some characteristic is e.g. Mendelian (I'd doubt the greed is, as normally defined).

It got me thinking that to cross the two domains, there is also a meta-concept of cultural viruses ("memes") to which Dawkins applied Darwinian model. Definitely not hard science, but they kind of counter your point that "there's NOTHING natural about our economic systems".


I mean, it's true that you might see phenomena that echo natural systems or things, but I suppose what I'm getting at is: unlike natural systems, the "rules" can be changed.

Honestly, what helped me a lot is: Economic systems are more like video games than "nature." Sure, video games can look like nature, but also are extremely malleable.


> with keys that are in memory on the same system

I'm not sure that actually holds — the encryption keys are in memory, but the decryption keys don't necessarily have to be.

The pre-encrypted payloads definitely are in memory at some point; however snatching them probably involves larger-scale reverse-engineering.


If they're using standard TLS, the actual data encryption is symmetric, so the encryption keys are the decryption keys and must be in memory during the encryption process.


If it is TLS you can get the keys used in the session from lsass’ memory. I’ve even written a tool to do so in PowerShell https://gist.github.com/jborean93/6c1f1b3130f2675f1618da5663.... This will generate a log file that contains the keys needed for Wireshark to decrypt TLS traffic.


My claim is it's not standard TLS or there's an additional layer (external encryption key) because an actual decryption of telemetry traffic has never been demonstrated.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: