Hacker Newsnew | past | comments | ask | show | jobs | submit | pcj-github's commentslogin

Absolutely insane. Security so weak, it seems like you discovered an intentional backdoor.


My NSL detector is off the charts here.


For anyone not familiar with the abbreviation: https://www.eff.org/issues/national-security-letters/faq


> impersonation tokens, called “Actor tokens”, that Microsoft uses in their backend for service-to-service (S2S)

Literally every single "security" framework uses God-mode long-lived tokens for non-human identities.

(Except for SPIFFE, but that's a niche thing and used only for Kubernetes bullshit.)

The whole field of "security" is a farce staffed by clowns.


AWS had switched from using something like this ("injection tokens") to just regular IAM roles, though managed by the AWS.

The only special permission that services (actually, the AWS accounts that they use) inside the AWS have is access to "service principals". The service roles inside customer accounts then use them to grant access.

AWS IAM is painful, but it shows that you can design a secure permission system.


You can add many layers of indirection, but unless you're actually authenticating that a system service is using the credentials (and not, say, a user or a script) then it boils down to a long-lived token at the end.


You can condition IAM on Nitro attestation, so that's doable (if a lot more work than usual).


Regular individual systems that run the code inside the AWS generally do not have long-lived tokens. The credentials are ultimately _pushed_ to the systems running the services by a small set of highly secured and monitored privileged systems.

You get to see that even with the regular public AWS/EC2. Instance roles are managed externally from the customers' points of view.


> highly secured and monitored privileged systems

So, ultimately "keys to the castle" aka a long password?


It's a bit more complicated :) There are HSMs and code signing thrown into the mix. They went into total overengineering mode when designing it.

But ultimately, any realistic design will eventually have systems that have to be trusted. It's just a question of isolating them.


If the long-lived token is actually a private key that is non-retrievable and the secrecy and origin is attested by a HSM, I'm fine with that.


If this turns out to be real, a direct shot to the left carotid artery. Theoretically could be survivable but not without serious deficit and stroke. Agree likely fatal.


The other indicators are pretty clearly a spinal shot. Extremely likely he is dead.

I'm going to hug my family a little tighter tonight. 46th school shooting of the year, and the 47th also happening in Colorado.


He lost conscious immediately which is not explainable with blood loss alone that fast - which may indicate that there was a higher impact from the shot.


It's not a case of losing blood, it's a case of failing to move blood to the right place. If the shot took out the carotid, then (nearly) 50% of the blood supply to his brain is gone because of a piping failure. That can absolutely cause instantaneous loss of consciousness, no direct brain trauma necessary.

This is very different than bleeding from, say, a major artery in a leg. In that case the issue isn't loss of piping to the brain, it's losing blood until the total blood volume in the body isn't sufficient to maintain a workable blood pressure, and yes that can take multiple minutes before a person loses consciousness.


You can live with single carotid [1]. But maybe the change is too fast. It is exremely difficult to say without knowing more.

1: https://biologyinsights.com/can-you-live-with-one-carotid-ar...


I am a physician, so I can say this with a high degree of confidence.

That snippet is referring to the circle of Willis*, which is a "backup" circuit that can route around a blockage to the blood flow to the brain on one side.

The thing is the circle of Willis is tiny and near vestigial (there is a substantial fraction of the population where it doesn't even make a full circuit), whereas the carotid is one of the largest blood vessels in the body. The circle of Willis isn't nearly large enough to reroute all that flow. It has to be made bigger over time through a process called collateralization, and that's a process that happens over months to years, not minutes or seconds.

In short, the circle of Willis will save you from years of high cholesterol that lead to a huge cholesterol plaque completely blocking off one of your carotids. It won't save you from your carotid being severed by a bullet.

*And some other tinier vessels, but mainly the circle of Willis


Not a physician, medical examiner, or the like. But a paramedic who has attended more than one fatality shooting. My educated wild ass guess is that hitting the neck with a high-velocity rifle would cause the shockwaves of the impact to be very, very close to the brainstem and to have a significant effect on it.


I was trying to frame it differently - like - it must have hit some harder tissue before it can cause the shockwaves, right?


The air itself would be concussive.

But regardless, the specific mechanism of his death is clear. He died by gunshot.


I don't believe the Trump regime has any intention to make the economy better, nor cares in the least about the citizenry. This is about introducing levers to imposing fascism, favoritism, and loyalty tests upon corporate america.


This resonates with me. I feel like AI is making me learn slower.

For example, I am learning Rust, for quite awhile now. While AI has been very helpful in lowering the bar to /begin/ learning Rust, it's making it slower to achieve a working competence with it, because I always seem reliant on the LLM to do the thinking. I think I will have to turn off all the AI and struggle struggle struggle, until I don't, just like the old days.


I've found the same effect when I ask the LLM to do the thinking for me. If I say "rewrite this function to use a list comprehension", I don't retain anything. It's akin to looking at Stack Overflow and copying the first result, or going through a tutorial that tells you what to write without ever explaining it.

The real power I've found is using it as a tutor for my specific situation. "How do list comprehensions work in Python?" "When would I use a list comprehension?" "What are the performance implications?" Being able to see the answers to these with reference to the code on my screen and in my brain is incredibly useful. It's far easier to relate to the business logic I care about than class Foo and method Bar.

Regarding retention, LLMs still doesn't hold a candle to properly studying the problem with (well-written) documentation or educational materials. The responsiveness however makes it a close second for overall utility.

ETA: This is regarding coding problems specifically. I've found LLMs fall apart pretty fast on other fields. I was poking at some astrophysics stuff and the answers were nonsensical from the jump.


> It's akin to looking at Stack Overflow and copying the first result, or going through a tutorial that tells you what to write without ever explaining it.

But if you're not digesting the why of the technique vis a vis the how of what is being done, then not only are you gaining nothing but a check mark in a todo list item's box, but you're quite likely introducing bugs into your code.

I used SO yesterday (from a general DDG search) to help me learn how to process JSON with python. I built up my test script from imports to processing a string to processing a file to dump'ing it to processing specific elements to iterating through it a couple of different ways.

Along the way, I made some mistakes, which were very helpful in leveling-up my python skills. At the end, not only did my script work, but I had gained a level of skill at my craft for a very specific use-case.

There are no shortcuts to up-leveling oneself, my friend, not in any endeavor, but especially not in programming, which may well be the most difficult job on the planet, given its ubiquity and overall lack of quality.


Try using the LLM as a learning tool, rather than asking it to do your job.

I don't really like the way LLMs code. I like coding. So I mostly do that myself.

However I find it enormously useful to be able to ask an LLM questions. You know the sort of question you need to ask to build an intuition for something? Where it's not a clear problem answer type question you could just Google. It's the sort of thing where you'd traditionally have to go hunt down a human being and ask them questions? LLMs are great at that. Like if I want to ask, what's the point of something? An LLM can give me a much better idea than reading its Wikipedia page.

This sort of personalized learning experience that LLMs offer, your own private tutor (rather than some junior developer you're managing) is why all the schools that sit kids down with an LLM for two hours a day are crushing it on test scores.

It makes sense if you think about it. LLMs are superhuman geniuses in the sense of knowing everything. So use them for their knowledge. But knowing everything is distracting for them and, for performance reasons, LLMs tend to do much less thinking than you do. So any work where effort and focus is what counts the most, you're better off doing that yourself, for now.


Why are you using an LLM at all when it’ll both hamper your learning and be wrong?


> While AI has been very helpful in lowering the bar to /begin/ learning Rust


The world will slowly, slowly converge on this but not before many years of hyping and preaching about how this shit is the best thing since sliced bread and shoving it into our faces all day long, but in the meantime I suggest we be mindful of our AI usage and keep our minds sharp. We might be the only ones left after a decade or two of this.


Nah you are getting it wrong the issue here is YOU NO LONGER NEED TO LEARN RUST thats why you are learning it slow.


Yeah. AI will write Rust and then you only have to review .. oh.

But AI will review it and then you only have to .. oh

But AI will review AI and then you .. oh ..


Does not really say /how/ it's performing a web search... Is it tapping into it's "own" corpus of material or calling out to some other web search engine?


In my quick experiment (asking a question that would naturally lead to content on my own site) it is not doing a real time request to the site in question. Its answer included links back to my site (and relevant summaries), but there was no requests for those pages while it was generating its answer. So it's clearly drawing from info that has already been scraped at some earlier point. And given that I see Claudebot routinely (and politely) crawling the site I'd guess it's working from it's own scraped copies (because why use someone else's if you've got your own....)


Major AI players don’t want to use someone else web index as they may cut it off or jack up the prices etc. major players want to build their own web index


And this is why we see our logs overloaded with ABot BBot CBot etc, every single "AI" company makes their own bot and they all crawl the same pages over and over.


A new car purchase should make the buyer feel /good/. With Tesla, it just doesn't feel good anymore. It feels dirty, dishonest, and corrupt. No thanks.


You ain't seen nothing yet.

In a few short weeks, Trump imploded the fundamental US brand from good to um, pretty much pure evil. We are untrustworthy backstabbers. Rightly so, people hate us now; they are literally burning the American flag all over the world. USA products and services are toxic items. Not that we make much money off the travel industry, but you'd have to be a complete idiot to vacation in (or really even travel to) the US now.

It's going to get really ugly; I don't think people get it yet.


I think in various parts of the world people were already quite negative towards US. What happens now though is that some other countries will have second thoughts. I hope enough people can distinguish between one administration and "the people", but trust is hard to gain and easy to loose, so yes, some things will get harder.


Countries? My friend right now add there all former US allies, including whole Europe and both your neighbors. Maybe gaining some new like guy from Argentina, Saudis with their murderous chieftain, and of course lets not forget biggest country on Earth by landmass.

US is a bully, and extremely unreliable one. We're in a no-trust era now. You will find some sympathizers of him everywhere of course, they mainly align with russian war supporters, at least in Europe. No surprises.

All this could reverse eventually but I just don't see it happening. 4 years is painfully long period and things will change forever, and I suspect not in ways 'architects' wish for. God I desperately hope we have at least some leaders with balls in Europe now that can steer adaptation to new situation quickly. We have massive potential at least matching current US one, but incorrect ideology for these times. And I suspect in 4 years situation won't change dramatically, if at all.

Remember those times that were, and how they were, how world was. I slightly feels like when 60s hippie era died and one Hunter S. Thompson quote comes to mind.


I'm reading his book Hell's Angels: A Strange and Terrible Saga right now and there's an uncanny resemblance to present day in his comments about both the media and the ignorant, violent and societally useless men with deep-seated masculinity issues who became the Hells Angels (or MAGA as it is now).


The US was already granted its mulligan in 2020. And then 4 years later the populace went and double down on all of this. It won't be so easy going forward.


> I hope enough people can distinguish between one administration and "the people"

"The people" voted for this administration precisely because of its xenophobic stance. Nearly half of us didn't want this, but we're going out the bathwater regardless: the majority and the administration are in agreement, and that's the correct perspective to have on the situation.


I'm sorry to break the news to you, but for a large section of the world population (especially in the global South), the US was the villain for a long time before Trump came along - and I don't mean only in the "evil empire" countries.

Trump only managed to spread this sentiment into the West, where it wasn't dominant so far, and sow doubts among formerly close allies.


Sure but we are talking about economics, and now the list includes our two biggest trading partners. Why he thinks making every day Canadians hate us is good strategy is beyond me.


If the US being a villain to most of the world is a surprising concept to you, I highly suggest you read about the original 9/11 in Chile.


As a Brit I'm more negative about Trump/Musk than the US as a whole. That's probably true of much of the world.


Europeans don't like Americans, but are happy for Uncle Sam to bankroll their defense while they take 4-6 week summer vacations, retire at 60 with pension, have free education and throw away welfare on illegal migrants.

Maybe it's time to cut down the $700+B/year of spending on NATO and let the proud Europeans pick up the slack?


We both know that US wanted to do it, because that’s how you become the global soft-power and have influence on every other nation. Also, it’s not the fault of Europe that Americans don’t want free education, pension, 4-6 week summer vacations and etc.

You’re trying to find a reason why quality of life is worse in the states, compared to Europe and some Asian countries. However, you’re not willing to blame yourselves, and will keep finding an excuse.

Most of people who say the same thing at the same time call Europeans “poor, no growth, no ambition” citizens. And that’s ok. But you can’t have it both ways, you know. Go enjoy your richness or growing stock market.


Europeans went wild with their social welfare spending so badly that now they need to import 3rd worlders because they have too many people who are on the government dole and not enough young people to pay into the system. Quite ironically, these "guests" are ending up eating away further from the welfare system and repaying their hosts with terrorism, as was recently seen, and will continue to be seen.

Also, it's easy to have social welfare when you have a homogeneous high-trust society... The more migrants the EU lets in, the more you see the whole thing deteriorate.

There's no such thing as "free" anyway, it's always paid by someone else. Pension at 60 is unsustainable, free education just devalues it, making it harder to fire people makes it harder to hire people, etc...

Europe is in economic decline, it's in population decline (as many other western nations btw), it's becoming more authoritarian (the UK prolly arrests more people for social media posts than Russia nowadays), and it's failing to compete on the world stage.


Again, literally all of it are just projections. Eurozone quietly accepts non-double-digit growth YoY in exchange for fairly balanced life style. If you guys don’t want that, that’s up to you. Until this point, all the previous governments in charge made their decisions on behalf of Americans. Retroactively blaming others is just… weird? Go figure out a government or method that’s best for you, since everyone writes their own destinies. At the end of the day, everyone will adapt, change and survive. To the better or worse. Pointing at others’ houses’ messiness while yours is extremely far from being clean is just not nice.


You might be surprised how much American "double digit growth" is just the upper class erasing the middle class.


Fair. I just really dislike when someone actively starts bullying others and talking down on them. Especially when the life in their own state is just, objectively, by most metrics, is worse.


Balanced poverty lol. And it isn't "accepted", the EU is having a meltdown about how they're becoming less and less competitive vs EU. No politicians has ever said "yep, all the policies we support are the reason you're falling behind, and that's a good thing!"

(And I'm British, so this isn't some pro American rant)

The UK's pathetic growth, bad under the previous government, now even worse under a new leftist government that is bringing in continental style employment regulations etc, is the main topic of national debate right now


> Europeans went wild with their social welfare spending so badly that now they need to import 3rd worlders because they have too many people who are on the government dole and not enough young people to pay into the system. Quite ironically, these "guests" are ending up eating away further from the welfare system and repaying their hosts with terrorism, as was recently seen, and will continue to be seen.

As a "3rd worlder" that migrated to Europe, this comment is wrong on so many levels that I have my doubts if you are trolling or are just really stupid. Maybe a little bit of both.

Europe imports people for the very same reason the US imports people (and the US imports A LOT of people). Advanced economies are complex beasts that need manpower and expertise beyond what a single nation can generate - And most European nations are small-ish.

The country I originally moved to actually had unemployment in low single digits. It needed people. It was not because "everyone was living on the dole".

But you are free to repeat your fairly racist and jingoistic bullshit around. It's a free world after all.


Sorry to continue the thread, but it’s a bit baffling to see how a good chunk of America really thinks without them everyone else would be a toast. Sure, we would be worse off, but so would they. Basic self-sufficiency is almost every normal government’s major goal.


By all means, I am enjoying this.

For a very long time I wanted EU (and other parts of the world) to rid itself from US influence, that I consider to be malignant to progress. US always leveraged its power (both soft and hard) to its own benefit first and foremost.

What I never expected is that this would happen by the US itself shitting its own pants so hard. I am actually very optimistic that EU will be forced to step up its integration, and other economies will be forced to step up on trading among themselves (not only goods, but also knowledge, services and cooperation) to replace the vacuum left by the former all powerful ally.

Interesting times ahead.


The US literally bailed Europe out in two world wars. Does that fit your category of "not being toast"?

When someone else bankrolls your defense by spending almost a trillion dollars a year that leaves quite a lot of the budget for other things, doesn't it?


Don't want to discuss your statement about "bankrolling" here, I'm not into the topic enough.

However, since this post is about US GDP I'm now curious, what do you think where this money is going and contributing to GDP?


> When someone else bankrolls your defense by spending almost a trillion dollars a year

That is the whole defense budget from the US, not how much it spends in Europe.

And yes, EU should stop relying in the US for defense. That arrangement only benefits the US, to be frank, EU should develop its own defense industry instead of strengthening the defense industry of a foreign nation. Especially now that said foreign nation is essentially enemy territory.


too funny how the MAN made you believe you cant have nice things because of “nato budget” :)


Whoa, and who's gonna replace the loss in the primes' revenue, hmmm? They pay top dollar lobbyists to prevent such a radical notion.


> bankroll their defense

Like post 9/11 Article 5 or Afghanistan or Iraq?

Also decent amount of European defense budget went to US manufacturers. This will probably change with de-facto end of NATO.


True but still a massive net gain for America. The irony is, as the Founders knew, America can actually afford to basically not even have a standing army, it's a massive, heavily civilian armed continental sized country with weak neighbours and an ocean either side. So logically Europe should have a far larger defence budget than America.


lol

Not only could America have had better benefits than Europe but you guys chose over and over again not to yet it’s Europe’s fault.

Love watching you guys shoot yourselves and yell at others. Popcorn has never tasted better.


> Not only could America have had better benefits than Europe but you guys chose over and over again not to yet it’s Europe’s fault.

The social welfare experiment has negative expectation. That's partly why the Europeans are importing young migrants from 3rd world countries who despise them -- they are running out of people who pay into the ponzi scheme.

I can't wait for Trump to exit NATO and show that the European king really had no clothes after all.


I can’t wait either. Because then Europe will get its shit together and reduce its need on America. Then you guys are truly fucked.

See the news about the 800 billion euro investment in Europe for Europe defense? Thanks America. Also did you see the stock market? To think that tariffs would somehow benefit America. All you’re doing is isolating yourselves and forcing decoupli by. Let me know how your relationship with Russia goes. According to history, not very well :)


I just honestly cannot fathom how you voted for this person and somehow surprised by this. Were you just not paying attention since 2016?


This


Zelensky is not responsible for this exchange. Are you honestly suggesting cower to a false autocrat? That is not leadership.


you can't beg someone to come save you, then shit on them in the same conversation ...in what world would anyone expect a warm reception to that?


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: