It's crazy I am being downvoted, though. Like, I am complaining about their processes that failed, and people are somehow on GitHub's side. Really weird stuff.
Nobody at GitHub expected this? Their feature develoment&release processes must be garbage/non-existent/not followed. This potential security issue should have been flagged when the new feature was thought up, security should have been part of the process of implementing the feature giving continuous feedback, and it should have been tested for before release of the feature. That's how modern security teams work in large, well-functioning organisations.
What is going on over there? No process, no oversight, just YOLO? Super-scary, because it means other stuff that we don't see is likely to be done in a similar manner.
My friend bought an apartment. In February. Still in processing at the Amt (bureau). It's nightmare fuel. They are sending physical letters, and are hand-matching payments from banks. Apparently, they couldn't match a 53 EUR transfer last week, so a ~400k EUR payment is stalling.
The issue is, the people holding the stamps (and believe me, they ARE stamps, with ink and all) are in charge, and are VERY reluctant to give up that comfy job. Zero accountability, too, since once you are a government employee, it's incredibly hard to get fired. So they stall the process, forever, without any reprecussions.
I am all for having and caring about process and dealing with everyone equally. That's why I live in Germany and not in Eastern Europe where often some money under the table is the only oil in the machine. No such oil in the German machine, thankfully. But it's infuriatingly slow, because bureaucrats are in control and will never willing give up that control.
Data Protection Authority (DPA) should investigate. In Germany, the company's DPO (Data Protection Officer) has personal, criminal liability. For these cases, I'd like to see them in front of criminal court, and see what happens. I wanna see someone having a criminal record for this, and then all the stupid excuses of large companies about "I didn't know" and "I thought lalalala" will stop rather quickly. It will turn out that, at the end of the day, it was just a resource issue. And when criminal liability is on the table, resources magically... appear.
You don't need $300 gear to do Level 2. A lot of people who are pretty up there the "pro" scale use something similar to a FNIRSI DWS-200 200W, which I bought for $90, with shipping. It comes with 8 tips, and is extremely tight, supports fast tip switching, very fast heating (auto-spleep, etc), very nice interface, short tip, etc. Yes, the tip is not well-calibrated temp wise, but you can get a non-certified calibrator for $15. I work on RC planes and associated flight controllers with it all day long. The annoyingly expensive area is the hot air station, actually, but that's really a bit "out there" -- the cheap(er) copies don't yet exist, so it's still on the expensive side. A good hot air station is where it's more like lev 2.5 -- with it, you can do HDMI/USB port changes reliably, and in seconds. The BGA etc. is lev 3.
Beyond the soldering iron, my recommendations that are not too obvious at first sight:
* solder paste (verrrry useful, just get it, and use it)
* something to purify air that _pulls_ it (a reverse fan) with a carbon filter (~30 USD)
* magnifying glass, hopefully attached to a ring of LEDs + a stand so you can see what you are doing (30-60 USD)
It essentially already has one. Probably only self-levelling, but has some extra programming like delayed flaps, wheel-up sequence (first up the wheels, then close the doors), blackbox feature, etc. Likely using a version of Ardupilot [1] that's already in use by everyone. Maybe INav [2], but I'd wager on the former. There's more than one computer in there, too. The receiver is likely double-redundant (2 receivers, each with 2 separate receiver circuits, one 900MHz, the other 2.4GHz). I have planes costing 400 EUR that have dual-bandwidth redundant receivers (costs 40 EUR, a joke).
ELRS (radio), Ardupilot (Flight Controller), EdgeTX (Radio OS), and Mission Control (Ground Station SW) are serious tools used by many in the hobby. Them being open means there's a lot of competition and a lot of features. But also not amazing UX :)
Yes, agree. At the same time, it's what these top-tier universities are known for: presenting something relatively simple as if it was ground-breaking, but in a way that the average person can (or has a better chance to) understand it. I am still unsure whether the communication quality has such added value. But people seem to like it, so here we are.
Honestly, the more research papers I read, the more I am suspicious. This "surprisingly" and other hyperbole is just to make reviewers think the authors actually did something interesting/exciting. But the more "surprises" there are in a paper, the more I am suspicious of it. Often such hyperbole ought to be at best ignored, at worst the exact opposite needs to be examined.
It seems like the best students/people eventually end up doing CS research in their spare time while working as engineers. This is not the case for many other disciplines, where you need e.g. a lab to do research. But in CS, you can just do it from your basement, all you need is a laptop.
I still remember the time when a gcc bug caused MiniSat to output UNSAT for a satisfiable problem [1]. I was the author of a SAT solver, and I was chasing my tail trying to figure out why I was getting UNSAT for a satsifiable problem. I have to admit I didn't expect it to be a gcc bug... (note: bug was found by Vegard Nossum on the CryptoMiniSat mailing list)
I worked at a company that wanted to implement an AI chatbot. I was helping to review the potential issues. On the first try I realised it was given full access to all past orders, for all customers via an API it could query in the background. So I could cajole it to look up other people's orders. It took less than 3 minutes of checking to figure this out.
Often engineers and especially non-technical people don't have the immediate thought of "let's see how I can exploit this" or if they do, they don't have the expertise to exploit it enough to see the issue(s). This is why companies have processes where all serious external changes need to go through a set of checks, in particular, by the IT security department. Yes, it's tedious and annoying, but it saves you from public blunders.
Such processes also make sure that the IT security department knows of the new feature, and can give guidance and help to the engineers about IT security issues related to the new feature. So if they get feedback about security issues from users they won't freak out and know who to contact for support. This way, things like accusing the reporter for "blackmailing" don't happen.
In general, this fiasco seems to show that Eurostar haven't integrated their IT security department into their processes. If there was trust and understanding among the engineers about what the IT department does, they would have (1) likely not released the tool with such issues and (2) would have known how to react when they got feedback from security researchers.
Honestly US standards can go to hell. I absolutely abhor these monstrosities. They should be outright banned except if specific need can be shown. They are dangerous, take up way too much space, and excessively damage the road.
Your freedom to do stuff stops where my freedom to walk & cycle around without undue fear of death begins.
“Because children grow up, we think a child's purpose is to grow up. But a child's purpose is to be a child. Nature doesn't disdain what lives only for a day. It pours the whole of itself into the each moment. We don't value the lily less for not being made of flint and built to last. Life's bounty is in its flow, later is too late. Where is the song when it's been sung? The dance when it's been danced? It's only we humans who want to own the future, too. We persuade ourselves that the universe is modestly employed in unfolding our destination. We note the haphazard chaos of history by the day, by the hour, but there is something wrong with the picture. Where is the unity, the meaning, of nature's highest creation? Surely those millions of little streams of accident and wilfulness have their correction in the vast underground river which, without a doubt, is carrying us to the place where we're expected! But there is no such place, that's why it's called utopia. The death of a child has no more meaning than the death of armies, of nations. Was the child happy while he lived? That is a proper question, the only question. If we can't arrange our own happiness, it's a conceit beyond vulgarity to arrange the happiness of those who come after us.”
YES. The "This is evidenced by the new set of hacker values being almost purely performative" is so incredibly true. I went to a privacy event about Web3, and the event organisers hired a photographer who took photos of everyone (no "no photo" stickers available), and they even flew a drone above our heads to take overarching videos of everyone :D I guess "privacy" should have been in quotes. All the values and aesthetics of the original set of people who actually cared about privacy (and were attracted to it) has been evaporated. All that remained are the hype. It was wild.
SAT solvers are used _everywhere_. Your local public transport is likely scheduled with it. International trains are scheduled with it. Industrial automation is scheduled with it. Your parcel is likely not only scheduled with it, but even its placement on the ship is likely optimised with it. Hell, it's even used in the deep depths of cryptocurrencies, where the most optimal block composition is computed with it. Even your friendly local nuclear reactor may have had its failure probability computed with (a variation of) it. In other words, it's being used to make your life cheaper/better/safer/easier. Google a bit around, open your eyes Neo ;)
PS: Yes, I develop a propositional SAT solver that used to be SOTA [1]. I nowadays develop a propositional model counter (for computing probabilities), that is currently SOTA [2]
Author of CryptoMiniSat here :) XOR+CNF is indeed supported by CryptoMiniSat. Which is cool, but if you _really_ think about it, the resolution operator over these two are gonna give you multivariate polynomials over GF(2). So resolution is poor in CryptoMiniSat, because it only encodes one of the constraints that this polynomial implies (i.e. one that can be encoded in a single disjunctive clause). And if you wanna do the _real_ deal, i.e. "properly" solve multivariate polynomials over GF(2) then you are in for a ride -- the all-powerful, much-feared, Grobner basis algorithms, and I am not touching those with a 100m pole, because they are hell on wheels :) I mean... it's possible to contribute to them, and I know of two people who did: https://theory.stanford.edu/~barrett/fmcad/slides/5_Kaufmann... and of course, https://link.springer.com/chapter/10.1007/978-3-031-37703-7_... i.e. Daniela and Alex. It's... rough :D