News Nug
How We Hacked a Software Supply Chain for $50K

Published: 2025-02-13 | Origin: /r/programming

In February 2025, Roni Carta reflects on his journey in offensive security, particularly in Bug Bounty Hunting, where he identifies and reports vulnerabilities to earn monetary rewards. Initially struggling to identify critical vulnerabilities, his skills improved significantly through collaboration with Snorlhax, a competitor on the HackerOne French Leaderboard. Together, they focused on a specific bug bounty program, successfully discovering multiple high-value vulnerabilities, each worth $10,000. They transitioned from competition to collaboration, identifying various bugs such

YouTube's New Hue

Published: 2025-02-13 | Origin: Hacker News

YouTube, established in 2005, has evolved from a video-dating site into a major media platform with billions of daily users. Recently, to celebrate its 20th anniversary, YouTube updated its brand palette, introducing a softer shade of red and a new magenta gradient in key features like the video progress bar. Members of the art direction and design teams explained that the change was meant to keep the brand feeling fresh while respecting its iconic identity. They emphasized the importance of color in branding

Why cryptography is not based on NP-complete problems

Published: 2025-02-13 | Origin: Hacker News

The content discusses why cryptography does not rely on NP-complete problems, emphasizing that cryptographic schemes are based on the computational difficulty of specific 'hard' problems rather than NP-completeness. For example, RSA encryption is based on the difficulty of factoring the product of two large prime numbers. The security of RSA relies on the assumption that it would require an impractical number of operations (greater than \(2^{128}\)) to solve the problem, making it hard for randomly chosen instances. The

Tiny JITs for a Faster FFI

Published: 2025-02-12 | Origin: /r/ruby

In a recent discussion, Aaron Patterson addressed the need for a faster Foreign Function Interface (FFI) for CRuby, acknowledging that although Ruby programming is preferred, there are times when native code is necessary. He advocates for creating native extensions that keep the API minimal, allowing the majority of processing to occur in Ruby to benefit from optimizations provided by YJIT. This involves using native code as a thin wrapper for conversion between Ruby and native types. Patterson expressed his general reluctance towards F

The average CPU performance of PCs and notebooks fell for the first time

Published: 2025-02-12 | Origin: Hacker News

The content discusses a performance benchmarking graph that tracks over 1,000,000 CPUs. This graph shows year-on-year performance data based on thousands of results from PerformanceTest versions V5 to V11, updated bi-weekly. PerformanceTest V8, released in 2012, was notable for being the first version to collect single-thread performance data. Users can compare the performance of up to five different CPUs by selecting checkboxes below the graph. The copyright information indicates that this content is from Pass

The overuse of browser engines in desktop applications

Published: 2025-02-12 | Origin: /r/programming

Failed to fetch content - HTTP Status - 403

Thomson Reuters Wins First Major AI Copyright Case in the US

Published: 2025-02-12 | Origin: /r/programming

Thomson Reuters has achieved a significant legal victory in the first major AI copyright case in the U.S., winning against the AI startup Ross Intelligence. The lawsuit, initiated in 2020, accused Ross of infringing on Thomson Reuters’ copyrighted materials from its legal research platform, Westlaw. U.S. Circuit Court Judge Stephanos Bibas ruled in favor of Thomson Reuters, rejecting all of Ross's defenses and affirming that Westlaw's editorial content is copyrighted and cannot be used without permission,

5G networks meet consumer needs as mobile data growth slows

Published: 2025-02-12 | Origin: Hacker News

The article questions the ongoing push for increasing mobile bandwidth, suggesting that the demand for higher data speeds may be stabilizing. Recent data indicates that growth rates for both terrestrial and mobile data are slowing, and that the demand for data speeds is likely to peak below 1 gigabit per second in the near future. Historically, the assumption of continuous growth in broadband rates has driven extensive research and development in telecommunications. However, the actual usage patterns show that most consumer applications do not require speeds exceeding 1 Gb

The Prophet of Parking: A eulogy for the great Donald Shoup

Published: 2025-02-12 | Origin: Hacker News

Professor Donald Shoup passed away on February 6th, and his influence on the political economy of parking and urban development is profound. M. Nolan Gray reflects on Shoup's unconventional yet impactful scholarly career, where he focused on the often-overlooked topic of parking. Despite its perceived dullness, Shoup’s work has reshaped urban planning, influencing policies such as San Francisco’s implementation of demand-based curb pricing in 2017 and the abolition of minimum off-street parking requirements in several

Inko: a programming language I've been working on for the last 10 years

Published: 2025-02-12 | Origin: /r/programming

Inko is a programming language designed for developing concurrent software with a focus on reliability. It provides features such as deterministic automatic memory management, move semantics, static typing, type-safe concurrency, and efficient error handling, enabling developers to avoid common issues like unpredictable performance and race conditions. Inko compiles source code to machine code using LLVM. For installation instructions, examples, and further information, users can consult the Inko website and documentation. The source code is licensed under the Mozilla Public License version 2

I failed my Anthropic interview and came to tell you all about it so you don't have to

Published: 2025-02-12 | Origin: /r/programming

The content describes the application process for a Research Fellowship at Anthropic, a company known for its AI model Claude, which is supported by significant investments from Amazon. The application process involves several stages: 1. **Online Coding (1.5 hours)**: Applicants must code a class exposing a public API according to specifications. The task is challenging and fast-paced, requiring applicants to think quickly and code efficiently, often ignoring optimal algorithm practices. The evaluation is automated without a human interviewer. 2. **Face

TL;DR of Deep Dive into LLMs Like ChatGPT by Andrej Karpathy

Published: 2025-02-12 | Origin: /r/programming

Andrej Karpathy recently released a detailed 3-hour and 31-minute video titled "Deep dive into LLMs like ChatGPT," which explores how large language models (LLMs) function. For those who lack the time to watch the entire video, a concise summary of the key points is provided. Key takeaways include: 1. **Data Acquisition**: LLMs begin by crawling the internet to create a large text dataset, which requires heavy filtering due to the presence of noisy,

Spanish 'running of the bulls' festival reveals crowd movements can be predicted

Published: 2025-02-12 | Origin: Hacker News

Failed to fetch content - HTTP Status - 400

Leaking the email of any YouTube user for $10k

Published: 2025-02-12 | Origin: Hacker News

In a recent exploration of Google's Internal People API, a researcher discovered that the functionality for blocking users on YouTube is reliant on an obfuscated Gaia ID, which is a Google account identifier, along with the blocked user's display name. This raised concerns because it appeared possible to leak the actual Google account identifier of any user blocked in a YouTube live chat. Upon testing, the researcher confirmed that when a user is blocked, their obfuscated Gaia ID can be found in a personal blocklist on a Google

Smuggling arbitrary data through an emoji

Published: 2025-02-12 | Origin: Hacker News

In a Hacker News comment, GuB-42 explores the potential for encoding data in emojis using Zero Width Joiner (ZWJ) sequences. Paul Butler confirms that it is indeed possible to encode arbitrary data in a single emoji without using ZWJ. He explains that data can be hidden in any Unicode character because Unicode assigns a unique codepoint to each character, represented in a format like U+XXXX. While simple Latin characters have a direct correspondence between codepoints and their visual representation, some characters

Ruby Caches - Improving Caching Via Benchmarks and Profiling with Vernier

Published: 2025-02-12 | Origin: /r/ruby

The content outlines a series of posts focused on Rails caching, particularly examining the network requests associated with caching. It emphasizes the importance of understanding caching use cases and the code structure for performance improvements. The author discusses the workflow of Rails caching, highlighting areas where time is usually spent and strategies to reduce latency. To drive performance enhancements, the author advocates using benchmarks and profilers, establishing a feedback loop for improvements, and incorporating these tools into the CI pipeline to track performance history and catch regressions. Additionally,

No longer writing my own damn HTML

Published: 2025-02-12 | Origin: Hacker News

The author has shifted from hand-writing HTML for their personal blog to using Zola, a static site generator. Initially, they enjoyed writing HTML but found the process increasingly tedious, especially when incorporating math with MathML, which is difficult to write by hand. Converting equations and highlighting code manually felt laborious, prompting them to create a Python script for LaTeX to MathML conversion. Eventually, the realization that they were wasting time on manual tasks led them to seek a site generator that met their

jj: a Git-compatible VCS that is both simple and powerful

Published: 2025-02-12 | Origin: Hacker News

Jujutsu is a powerful, Git-compatible version control system (VCS) designed for software projects, aimed at being user-friendly for both beginners and experienced users. It enables users to copy code, track changes, and publish updates. Unique to Jujutsu is its architecture, which separates user interface and version control algorithms from storage systems, allowing it to work with various backends, including Git repositories, improving compatibility with popular Git tools. The system draws inspiration from multiple other version control systems, incorporating

TL;DW: Too Long; Didn't Watch Distill YouTube Videos to the Relevant Information

Published: 2025-02-12 | Origin: Hacker News

Sure! Please provide the content you would like me to summarize.

The year I didn't survive

Published: 2025-02-12 | Origin: Hacker News

The author reflects on their transformative experience at the age of forty, marked by both profound loss and new life. Their husband, Jake, succumbed to cancer, while they gave birth to their daughter, Athena. The grief from losing Jake altered the author's identity and mental state, as their previous self, who managed Jake’s illness and recorded life's moments, died with him. The author describes feeling forgetful and paralyzed by anxiety, struggling with the heavy emotional burden of motherhood and loss. A letter from