Forwarded from HN Best Comments
Re: Fabrice Bellard Releases MicroQuickJS
Fabrice Bellard is widely considered one of the most productive and versatile programmers alive:
- FFmpeg: https://bellard.org
- QEMU: https://bellard.org/qemu/
- JSLinux: https://bellard.org/jslinux/
- TCC: https://bellard.org/tcc/
- QuickJS: https://bellard.org/quickjs/
Legendary.
ddtaylor, 10 hours ago
Fabrice Bellard is widely considered one of the most productive and versatile programmers alive:
- FFmpeg: https://bellard.org
- QEMU: https://bellard.org/qemu/
- JSLinux: https://bellard.org/jslinux/
- TCC: https://bellard.org/tcc/
- QuickJS: https://bellard.org/quickjs/
Legendary.
ddtaylor, 10 hours ago
Typst-based CV/resume generator for academics and engineers
https://github.com/rendercv/rendercv
https://github.com/rendercv/rendercv
Forwarded from Investigations by ZachXBT
Update: Hundreds of Trust Wallet victims & $6M+ stolen from the intial list of theft addresses
Update: Trust Wallet confirmed the incident on X
Update: Trust Wallet confirmed the incident on X
Forwarded from vx-underground
Ubisoft was a victim of MongoBleed.
An unknown Threat Actor(s) have exfiltrated the source code to basically every single Ubisoft product dating back to the 90's. This includes their Software Development Kits, Middleware, uPlay, RDV, etc.
No customer data was stolen
An unknown Threat Actor(s) have exfiltrated the source code to basically every single Ubisoft product dating back to the 90's. This includes their Software Development Kits, Middleware, uPlay, RDV, etc.
No customer data was stolen
This media is not supported in your browser
VIEW IN TELEGRAM
Forwarded from infinityhedge
Update From Trust Wallet:
So far, their investigation suggests that the Browser Extension v2.68 incident is likely related to the industry-wide Sha1-Hulud incident in November.
* Sha1-Hulud was an industry-wide software supply chain attack that affected companies across multiple sectors, including but not limited to crypto via compromised npm packages. It involved malicious code being introduced and distributed through commonly-used developer tooling. This allowed attackers to gain access through trusted software dependencies rather than directly targeting individual organizations.
* To date, this incident has impacted over ⅓ of the Fortune 100, among hundreds of other organizations.
* From November 25th to December 24th, the infection rate stabilized at a persistent level of approximately 100-200 new compromised repositories every day: Wiz
Important ⚠️ : Security Researchers warn that these type of attacks will get worse: infinityhedge
Read More here: https://www.wiz.io/blog/snipping-the-long-tail-of-shai-hulud-2-0
So far, their investigation suggests that the Browser Extension v2.68 incident is likely related to the industry-wide Sha1-Hulud incident in November.
* Sha1-Hulud was an industry-wide software supply chain attack that affected companies across multiple sectors, including but not limited to crypto via compromised npm packages. It involved malicious code being introduced and distributed through commonly-used developer tooling. This allowed attackers to gain access through trusted software dependencies rather than directly targeting individual organizations.
* To date, this incident has impacted over ⅓ of the Fortune 100, among hundreds of other organizations.
* From November 25th to December 24th, the infection rate stabilized at a persistent level of approximately 100-200 new compromised repositories every day: Wiz
Important ⚠️ : Security Researchers warn that these type of attacks will get worse: infinityhedge
Read More here: https://www.wiz.io/blog/snipping-the-long-tail-of-shai-hulud-2-0
Forwarded from HN Best Comments
Re: Show HN: 22 GB of Hacker News in SQLite
Don't miss how this works. It's not a server-side application - this code runs entirely in your browser using SQLite compiled to WASM, but rather than fetching a full 22GB database it instead uses a clever hack that retrieves just "shards" of the SQLite database needed for the page you are viewing.
I watched it in the browser network panel and saw it fetch:
As I paginated to previous days.
It's reminiscent of that brilliant SQLite.js VFS trick from a few years ago: https://github.com/phiresky/sql.js-httpvfs - only that one used HTTP range headers, this one uses sharded files instead.
The interactive SQL query interface at https://hackerbook.dosaygo.com/?view=query asks you to select which shards to run the query against, there are 1636 total.
simonw, 8 hours ago
Don't miss how this works. It's not a server-side application - this code runs entirely in your browser using SQLite compiled to WASM, but rather than fetching a full 22GB database it instead uses a clever hack that retrieves just "shards" of the SQLite database needed for the page you are viewing.
I watched it in the browser network panel and saw it fetch:
https://hackerbook.dosaygo.com/static-shards/shard_1636.sqlite.gz
https://hackerbook.dosaygo.com/static-shards/shard_1635.sqlite.gz
https://hackerbook.dosaygo.com/static-shards/shard_1634.sqlite.gz
As I paginated to previous days.
It's reminiscent of that brilliant SQLite.js VFS trick from a few years ago: https://github.com/phiresky/sql.js-httpvfs - only that one used HTTP range headers, this one uses sharded files instead.
The interactive SQL query interface at https://hackerbook.dosaygo.com/?view=query asks you to select which shards to run the query against, there are 1636 total.
simonw, 8 hours ago
GitHub
GitHub - phiresky/sql.js-httpvfs: Hosting read-only SQLite databases on static file hosters like Github Pages
Hosting read-only SQLite databases on static file hosters like Github Pages - phiresky/sql.js-httpvfs
https://en.wikipedia.org/wiki/Streetlight_effect
The streetlight effect, or the drunkard's search principle, is a type of observational bias that occurs when people only search for something where it is easiest to look.
The streetlight effect, or the drunkard's search principle, is a type of observational bias that occurs when people only search for something where it is easiest to look.
not recommending this tool (I hate its syntax and the way they are implementing things)
just putting it for inspiration or something idk
https://capnproto.org/
another alternative to protobuf codegen
just putting it for inspiration or something idk
https://capnproto.org/
another alternative to protobuf codegen
Do It by Code
48-digit prime numbers every git commit
The Miller-Rabin primality test is an algorithm used to determine if a very large number is a prime number. It is the standard method used in cryptography (like RSA key generation and the git-prime example above) because it is incredibly fast.
1. What is it?
It is a probabilistic algorithm. This is the most important distinction:
* Deterministic tests (like trying to divide the number by every smaller number) give you a 100% correct answer but are impossibly slow for large numbers.
* Miller-Rabin gives you an answer very quickly, but it trades absolute certainty for speed.
The output of the test is either:
1. Composite: The number is definitely not prime (100% certainty).
2. Probably Prime: The number is very likely prime.
2. Why do we need it for SHA-1?
As the source noted, SHA-1 hashes are 160-bit integers. That is a number roughly equal to 10 to the power of 48 (a 1 followed by 48 zeros).
If you used standard division to check if that number is prime, the sun would likely explode before your computer finished. Miller-Rabin can check it in milliseconds.
3. How does it work?
The math relies on Fermat's Little Theorem, which states that if p is a prime number, then for any integer a, a^(p-1) mod p = 1.
Here is the simplified process:
Step 1: The Setup
Let's say we want to test a big number n. We express n-1 in a specific form (2^s * d). This is basically factoring out all powers of 2.
Step 2: The Witness
We pick a random number a (called a base) that is smaller than n. We call this number a "witness."
Step 3: The Interrogation
We run a modular exponentiation calculation using a, s, and d.
* If the math doesn't balance out according to the theorem, a acts as a witness that proves n is Composite. We stop immediately.
* If the math *does* balance out, n passes the test for that specific witness.
Step 4: Repetition
Because there is a tiny chance a composite number could "trick" the test (called a Strong Pseudoprime), we repeat Step 2 and 3 with different random values for a.
Do It by Code
The Miller-Rabin primality test is an algorithm used to determine if a very large number is a prime number. It is the standard method used in cryptography (like RSA key generation and the git-prime example above) because it is incredibly fast. 1. What is…
A simple python implementation of it would be like this: (source)
import random
def is_prime_miller_rabin(n, k=40):
"""Miller-Rabin primality test - probabilistic but very reliable"""
if n < 2:
return False
if n == 2 or n == 3:
return True
if n % 2 == 0:
return False
# Write n-1 as 2^r * d
r, d = 0, n - 1
while d % 2 == 0:
r += 1
d //= 2
# Witness loop
for _ in range(k):
a = random.randrange(2, n - 1)
x = pow(a, d, n)
if x == 1 or x == n - 1:
continue
for _ in range(r - 1):
x = pow(x, 2, n)
if x == n - 1:
break
else:
return False
return True
Media is too big
VIEW IN TELEGRAM
source - @sbrugnadlbot
labs.google/ProjectGenie
Step inside Project Genie: our experimental research prototype that lets you create, edit, and explore virtual worlds. 🌎
labs.google/ProjectGenie