zero_k

Wow, so true! Domain expertise is apparently not a requirement. At all. Wow.

It's crazy I am being downvoted, though. Like, I am complaining about their processes that failed, and people are somehow on GitHub's side. Really weird stuff.

Nobody at GitHub expected this? Their feature develoment&release processes must be garbage/non-existent/not followed. This potential security issue should have been flagged when the new feature was thought up, security should have been part of the process of implementing the feature giving continuous feedback, and it should have been tested for before release of the feature. That's how modern security teams work in large, well-functioning organisations.

What is going on over there? No process, no oversight, just YOLO? Super-scary, because it means other stuff that we don't see is likely to be done in a similar manner.

My friend bought an apartment. In February. Still in processing at the Amt (bureau). It's nightmare fuel. They are sending physical letters, and are hand-matching payments from banks. Apparently, they couldn't match a 53 EUR transfer last week, so a ~400k EUR payment is stalling.

The issue is, the people holding the stamps (and believe me, they ARE stamps, with ink and all) are in charge, and are VERY reluctant to give up that comfy job. Zero accountability, too, since once you are a government employee, it's incredibly hard to get fired. So they stall the process, forever, without any reprecussions.

I am all for having and caring about process and dealing with everyone equally. That's why I live in Germany and not in Eastern Europe where often some money under the table is the only oil in the machine. No such oil in the German machine, thankfully. But it's infuriatingly slow, because bureaucrats are in control and will never willing give up that control.

Citation needed :) That's a bold claim. May be true, but it's a bold one, so something backing it up would be nice.

Data Protection Authority (DPA) should investigate. In Germany, the company's DPO (Data Protection Officer) has personal, criminal liability. For these cases, I'd like to see them in front of criminal court, and see what happens. I wanna see someone having a criminal record for this, and then all the stupid excuses of large companies about "I didn't know" and "I thought lalalala" will stop rather quickly. It will turn out that, at the end of the day, it was just a resource issue. And when criminal liability is on the table, resources magically... appear.

It's time to be serious about this. Unacceptable.

I'll steal your ZD-8965 recommendation :) Thanks!

You don't need $300 gear to do Level 2. A lot of people who are pretty up there the "pro" scale use something similar to a FNIRSI DWS-200 200W, which I bought for $90, with shipping. It comes with 8 tips, and is extremely tight, supports fast tip switching, very fast heating (auto-spleep, etc), very nice interface, short tip, etc. Yes, the tip is not well-calibrated temp wise, but you can get a non-certified calibrator for $15. I work on RC planes and associated flight controllers with it all day long. The annoyingly expensive area is the hot air station, actually, but that's really a bit "out there" -- the cheap(er) copies don't yet exist, so it's still on the expensive side. A good hot air station is where it's more like lev 2.5 -- with it, you can do HDMI/USB port changes reliably, and in seconds. The BGA etc. is lev 3.

Beyond the soldering iron, my recommendations that are not too obvious at first sight:

* solder paste (verrrry useful, just get it, and use it)

* something to purify air that _pulls_ it (a reverse fan) with a carbon filter (~30 USD)

* magnifying glass, hopefully attached to a ring of LEDs + a stand so you can see what you are doing (30-60 USD)

* solder sucker, hopefully automated (5 USD non-automated, 80 USD+ automated)

It essentially already has one. Probably only self-levelling, but has some extra programming like delayed flaps, wheel-up sequence (first up the wheels, then close the doors), blackbox feature, etc. Likely using a version of Ardupilot [1] that's already in use by everyone. Maybe INav [2], but I'd wager on the former. There's more than one computer in there, too. The receiver is likely double-redundant (2 receivers, each with 2 separate receiver circuits, one 900MHz, the other 2.4GHz). I have planes costing 400 EUR that have dual-bandwidth redundant receivers (costs 40 EUR, a joke).

ELRS (radio), Ardupilot (Flight Controller), EdgeTX (Radio OS), and Mission Control (Ground Station SW) are serious tools used by many in the hobby. Them being open means there's a lot of competition and a lot of features. But also not amazing UX :)

[1] https://ardupilot.org/ [2] https://inavflight.github.io/

If they want "eco progress" they should make their devices repairable.

Reduce, Reuse, Recycle. *In that priority*

Reduce & Reuse by making it repairable!

See: https://www.epa.gov/recycle

Yes, agree. At the same time, it's what these top-tier universities are known for: presenting something relatively simple as if it was ground-breaking, but in a way that the average person can (or has a better chance to) understand it. I am still unsure whether the communication quality has such added value. But people seem to like it, so here we are.

Code & Readme: https://github.com/meelgroup/ganak/

It's not only about the token cost! It's also my TIME cost! Much-much more expensive than tokens, it turns out ;)

Honestly, the more research papers I read, the more I am suspicious. This "surprisingly" and other hyperbole is just to make reviewers think the authors actually did something interesting/exciting. But the more "surprises" there are in a paper, the more I am suspicious of it. Often such hyperbole ought to be at best ignored, at worst the exact opposite needs to be examined.

It seems like the best students/people eventually end up doing CS research in their spare time while working as engineers. This is not the case for many other disciplines, where you need e.g. a lab to do research. But in CS, you can just do it from your basement, all you need is a laptop.

I still remember the time when a gcc bug caused MiniSat to output UNSAT for a satisfiable problem [1]. I was the author of a SAT solver, and I was chasing my tail trying to figure out why I was getting UNSAT for a satsifiable problem. I have to admit I didn't expect it to be a gcc bug... (note: bug was found by Vegard Nossum on the CryptoMiniSat mailing list)

[1] https://www.msoos.org/2013/04/gcc-4-5-2-at-sat-competition-2...

I worked at a company that wanted to implement an AI chatbot. I was helping to review the potential issues. On the first try I realised it was given full access to all past orders, for all customers via an API it could query in the background. So I could cajole it to look up other people's orders. It took less than 3 minutes of checking to figure this out.

Often engineers and especially non-technical people don't have the immediate thought of "let's see how I can exploit this" or if they do, they don't have the expertise to exploit it enough to see the issue(s). This is why companies have processes where all serious external changes need to go through a set of checks, in particular, by the IT security department. Yes, it's tedious and annoying, but it saves you from public blunders.

Such processes also make sure that the IT security department knows of the new feature, and can give guidance and help to the engineers about IT security issues related to the new feature. So if they get feedback about security issues from users they won't freak out and know who to contact for support. This way, things like accusing the reporter for "blackmailing" don't happen.

In general, this fiasco seems to show that Eurostar haven't integrated their IT security department into their processes. If there was trust and understanding among the engineers about what the IT department does, they would have (1) likely not released the tool with such issues and (2) would have known how to react when they got feedback from security researchers.

Honestly US standards can go to hell. I absolutely abhor these monstrosities. They should be outright banned except if specific need can be shown. They are dangerous, take up way too much space, and excessively damage the road.

Your freedom to do stuff stops where my freedom to walk & cycle around without undue fear of death begins.

My favourite quote from him:

“Because children grow up, we think a child's purpose is to grow up. But a child's purpose is to be a child. Nature doesn't disdain what lives only for a day. It pours the whole of itself into the each moment. We don't value the lily less for not being made of flint and built to last. Life's bounty is in its flow, later is too late. Where is the song when it's been sung? The dance when it's been danced? It's only we humans who want to own the future, too. We persuade ourselves that the universe is modestly employed in unfolding our destination. We note the haphazard chaos of history by the day, by the hour, but there is something wrong with the picture. Where is the unity, the meaning, of nature's highest creation? Surely those millions of little streams of accident and wilfulness have their correction in the vast underground river which, without a doubt, is carrying us to the place where we're expected! But there is no such place, that's why it's called utopia. The death of a child has no more meaning than the death of armies, of nations. Was the child happy while he lived? That is a proper question, the only question. If we can't arrange our own happiness, it's a conceit beyond vulgarity to arrange the happiness of those who come after us.”

YES. The "This is evidenced by the new set of hacker values being almost purely performative" is so incredibly true. I went to a privacy event about Web3, and the event organisers hired a photographer who took photos of everyone (no "no photo" stickers available), and they even flew a drone above our heads to take overarching videos of everyone :D I guess "privacy" should have been in quotes. All the values and aesthetics of the original set of people who actually cared about privacy (and were attracted to it) has been evaporated. All that remained are the hype. It was wild.

SAT solvers are used _everywhere_. Your local public transport is likely scheduled with it. International trains are scheduled with it. Industrial automation is scheduled with it. Your parcel is likely not only scheduled with it, but even its placement on the ship is likely optimised with it. Hell, it's even used in the deep depths of cryptocurrencies, where the most optimal block composition is computed with it. Even your friendly local nuclear reactor may have had its failure probability computed with (a variation of) it. In other words, it's being used to make your life cheaper/better/safer/easier. Google a bit around, open your eyes Neo ;)

PS: Yes, I develop a propositional SAT solver that used to be SOTA [1]. I nowadays develop a propositional model counter (for computing probabilities), that is currently SOTA [2]

[1] https://github.com/msoos/cryptominisat/ [2] https://github.com/meelgroup/ganak/

Author of CryptoMiniSat here :) XOR+CNF is indeed supported by CryptoMiniSat. Which is cool, but if you _really_ think about it, the resolution operator over these two are gonna give you multivariate polynomials over GF(2). So resolution is poor in CryptoMiniSat, because it only encodes one of the constraints that this polynomial implies (i.e. one that can be encoded in a single disjunctive clause). And if you wanna do the _real_ deal, i.e. "properly" solve multivariate polynomials over GF(2) then you are in for a ride -- the all-powerful, much-feared, Grobner basis algorithms, and I am not touching those with a 100m pole, because they are hell on wheels :) I mean... it's possible to contribute to them, and I know of two people who did: https://theory.stanford.edu/~barrett/fmcad/slides/5_Kaufmann... and of course, https://link.springer.com/chapter/10.1007/978-3-031-37703-7_... i.e. Daniela and Alex. It's... rough :D

Just my 2 cents.

Wait, is this another algorithm where they didn't bother even cursorily looking at the classical algorithm for even a minute, then compare it with their stuff? Last time they pulled this, it was my field, and I could only laugh. Just stop this nonsense and start doing some real work. Yeah, I know their "work" seems to be "how to extract money using buzzwords" but it's getting tiring, and I don't consider that "work".

I wish I could tell a story. Alas, I can't. It turns out that large corporations are excellent at hiding evidence of wrongdoing, and will do everything to cover the backside of high-level execs, because stock price matters. When it's bad, the exec leaves for a "better opportunity", and none will be wiser. The stress of the honest, serious engineer(s) remain, and the exec gets a free ride to their next big beautiful step up the ladder. In retrospect, don't follow internal reporting guidelines, and don't talk to internal lawyers. They either are incompetent or competent, but paid to swipe stuff under the rug -- you'll never find out either way. Instead, go to the relevant regulatory agency, write a detailed report to them, and let it play out.

I am happy they demonstrated how useful these devices are. Marking these as "disposable" is a kind of insanity. I recovered a few of them "disposed" (i.e. "randomly thrown away into") in an empty flower pot, and took out the LiPo batteries from them -- which are rechargeable, and have charge circuitry (non-trivial for LiPos). That we somehow decided that it's OK to design these to be used only once feels wrong.

This is the opposite of repairability. We specifically made them impossible to reuse and refill. Makes my tinkerer (and eco-friendly) heart very sad.

Ah, interesting. Thanks, I'll look into it!

I work on a (once top-of-the-line) SAT solver [1] and a (currently top-of-the-line) model counter [2]. Actually, I am very interested in the part of the rebuttal of "when each constraint has at most two variables, then the constraint satisfaction problem (and even the more difficult problem of counting the number of solutions) can be solved in time less than the lower bound that is claimed" -- in the model counting competition [3] there are actually problems that are binary-clause only, and I have to admit I am having trouble counting them any smarter than I already do normal (i.e. >=3 length clause) problems. Is there some very fun algorithm I'm missing that I could use for only-binary clause solution counting? I have thought about it, but I just... can't come up with anything smarter than compiling it into a d-DNNF form, which most SOTA model counters (and so I as well) do.

[1] https://github.com/msoos/cryptominisat/ [2] https://github.com/meelgroup/ganak/ [3] https://mccompetition.org/

I'm also with Sparkasse and it's the worst. Their digital systems and their technical understanding is the bottom of the barrel. On the other hand, the "most digital bank" in Germany, N26, a so called "neobank" has laughable security [1]. It's a huge mess over here. I used to also bank in Singapore, the difference is night and day. Fun story: Sparkasse has an integration with a stock brokerage, and the stock charts are PNGs generated at the backend. It's literally 1995-level HTML usage, One can only laugh.

[1] https://archive.org/details/33C3-Shut_Up_and_Take_My_Money

Sometimes, I wish engineers running backend services were not hindered by management nonsense and would just nuke these systems when they are reported, sufficiently backed up with evidence (like here -- though I'd do a personal check first to verify). Seems like some did (congrats), others didn't (Firebase). I can assure you if I was on the other end, I would have escalated until I got fired or the service was down. Unimaginable that some let these run, wake up in the morning, look in the mirror and aren't ashamed of themselves.

People will continue doing their unethical behaviour not because we aren't on the streets fighting for the right thing, but because we just don't care enough, and let them continue.

Springer? You mean the publisher we are currently fighting so they won't mess up our peer-reviewed research paper that we wrote and paid for the privilege for them to mess up (ehm, sorry "publish")? Colour me surprised.

Haha, Marijn Heule who is pushing a lot of limits of SAT solving would love this. If you manage to get him excited, he might spend a few years on this problem :) He's kinda famous for solving the Boolean Pythagorean Triples problem using SAT [1]. He loves puzzles. He also got Knuth excited about a bunch of fun puzzles.

BTW, these puzzles also tend to have a lot of symmetries, which SAT solvers are pretty bad at handling. You can break them, though, using a variety of techniques, e.g. static symmetry breaking [2], or symmetric learning.

[1] https://www.cs.utexas.edu/~marijn/ptn/ [2] https://github.com/markusa4/satsuma