Hacker Newsnew | past | comments | ask | show | jobs | submit | sturob's commentslogin

For a good experience running Android apps on ChromeOS you really need an ARM CPU and a decent amount of RAM (12 or 16).



The person you responded to has an AMD framework laptop, which means they can do 96 of ram if they want (some users report success with 128GB). The laptop you linked only goes up to 16GB of ram.

That laptop only has 256GB of storage whereas you can throw a 4TB m.2 ssd into the AMD framework if you want.

That laptop only has 2 USB type-c and they're both only 5Gbps (and one legacy USB port). The AMD 7040 framework has 2 USB4 40Gbps ports and 2 regular USB type-c 3.2 ports (and then the whole modular card system in front of those ports).

That laptop looks genuinely nice. With a few small tweaks I'd consider it. Though, in terms of personal preference I wouldn't want to do a chromebook again because of the annoyance of having to rebind the keys on every operating system I install (the pixelbook had the caps lock key bound to super and IIRC F11 was bound to something that doesn't exist on normal keyboards), and I'll never buy an oled screen for/in a computer.


Could you clarify what you mean by 'attacks like this happen every day' please?


Here are just a few old well known examples in popular package managers:

* Gentoo: https://archives.gentoo.org/gentoo-announce/message/dc23d48d...

* Debian: https://lists.debian.org/debian-devel-announce/2006/07/msg00...

* NPM: https://eslint.org/blog/2018/07/postmortem-for-malicious-pac...

* PyPi: https://www.reddit.com/r/Python/comments/8hvzja/backdoor_in_...

* Ubuntu Snap: https://github.com/canonical-websites/snapcraft.io/issues/65...

* Arch Linux AUR: https://lists.archlinux.org/pipermail/aur-general/2018-July/...

* Homebrew: https://medium.com/@vesirin/how-i-gained-commit-access-to-ho...

No one has fixed the fundamental problems that allow any of these to happen after years and years.

Now put "supply chain attack" into any news search engine today.

Attacks of this nature are up by 400-1500%+ in recent years depending on whose estimates you trust. They are easy, they are common, they are everywhere... and most security engineers and sysadmins are entirely asleep on the wheel on this one.

Most of our consulting work these days is mitigating these risks in the most critical deployment and code paths of our clients.


Thank you, I was not aware of all of these, and I don't doubt the seriousness of the issue.

That said: 'every day' does seem quite hyperbolic.


There are several thousand expired email domains of maintainers right now on NPM alone, allowing you to easily take over their accounts if you wanted, arguably legally, for maybe $10. I bought the domain name of the sole maintainer of the NPM package "foreach", gaining control of their email address and likely password reset capabilities, just to prove this point and troll the press a bit, which worked better than I could have ever hoped. And yet, still not -enough- press because almost no one is doing anything about it yet.

With easily over a million published open source packages that exist, and it being -so- easy to take them over since almost no one uses hardware code signing or 2FA, and with well above 365 documented/discovered cases every year, (obviously not counting all the ones that are -not- discovered!) "every day" is a given.

If anything with LLM based pull request attacks spiking right now, I assume several malicious commits will be merged today. Most will look like accidents, hard to spot, and merged helpfully by bots that automatically merge commits to major distros. The floodgates are wide open.

"Sonatype logged over 245,032 malicious packages in open source projects available to public download in 2023, double the number seen from 2019 to 2022. In total, one in eight open source downloads poses a risk."

https://www.cpomagazine.com/cyber-security/open-source-softw...


Realizing that he needed Abrash (and aggressively recruiting him) could easily be seen as the most impressive thing he did to make Quake happen


I would say his multiple technical feats and phenomenal output are more impressive.


If they post


lol, so simple. True. Thanks.


The story they lead their marketing with ends:

“Cool! Now this will be with me wherever I go.”

So the next question is obviously:

"Will it? Forever? What are you doing to ensure that?"

Because most consumer startups fail. The ones that get bought out usually end up sunset or neglected. Even the ones that IPO often alienate users by chasing quarterly earnings (evernote/dropbox/pinterest).


Prenuvo give you a link to all the .dcm files downloadable in a zip.


Very cool. I wish this was around when I was a kid.


Do you use openssh?


Yeah, I have used it happily on Linux


"In January, Goldman disclosed that it had lost about $3 billion on the consumer-lending push since 2020."

Looks like Tim Cook will be joining Warren Buffett in the 'squeezing Goldman Sachs' hall of fame: https://markets.businessinsider.com/news/stocks/warren-buffe...


In the attached article

> After hovering around record lows for much of the pandemic, consumer delinquencies are rising across the industry.

> It lost slightly more than $1 billion in 2021 and $783 million in 2020, after accounting for operating expenses and money set aside to cover possible losses on loans

That seems like an enormous amount of money to support buy now and pay later


Apple has enough cash reserves to be able to be a bank themselves, but I guess are much too smart to use their own money.

Is the buy now, pay later all of what this stems from? I have never looked into it, but I assumed they were also backing the Apple credit card which I consider totally different from each other.


It's more than that. Consider Apple's strongest advantage, it's brand.

If Goldman is the one handling the lending, it is also the one sending you to collections.

The PR damage to Apple's brand can be significant


Goldman considers its brand a key asset.

“””Our assets are our people, capital and reputation. If any of these is ever diminished, the last is the most difficult to restore. “””

https://www.goldmansachs.com/our_firm/investor_relations/fin...

It’s the truth.

The retail bank was a mess. It’s a stepping stone for Solomon to disrupt the trading culture and take control of the bank from the investment bank. It costs a lot to set up a retail bank, and the political will was there to start but not to finish. The politics around the retail bank was hyper toxic, with a classic us and them mentality. The established tech and back office were marginalized and the retail bank tried to build it all themselves but learned the hard way very late those groups exist for a reason - regulatory and security bars are super high and can’t be achieved by hubris alone. Apple had extremely aggressive asks of the technical stack, they outsourced a lot of core stuff to SaaS finserv at a high margin, and a bunch of other issues. Finally the timing of it all was awful. They started in a super low rates cash flush world and things have gotten harder everywhere for them.

Source: I was there


Apple's reputation is focused on its consumer business. Financial news is unlikely to affect consumers' perception of them.

I doubt that Apple's reputation would be hit on this unless Goldman launched a PR battle to get Apple to let them out of the deal.


But Apple could take it to an 11 too. If they finance your equipment and you fall behind on your payments, guess whose equipment just went into lock-out mode... Apple could then allow the device to be returned to an Apple Store, and credit will be applied to the account. A voluntary return policy, only throw in a carrot of if you provide a memory stick, they'll make you a copy of the data for a small nominal fee.


That will most definitely destroy the brand


Ford, Chevy, Toyota, Honda, et al. repo cars daily, and their brands are not hurting. People know when they can't make payments that their collateral is likely to be collected.

I'm not saying I'm for them doing this or anything, but just taking the dystopian concept to a logical completion. We've already seen where self driving cars have been discussed repossessing themselves, so this is just the natural extension of the same concept. This forum tends to think that places like FB, Googs, etc should have a very negative brand due to the data collections, but the masses don't give a damn.


Those are typically dealers


Those are typically finance companies, so dealers are no where near repossession. Each of the big auto makers all have their own financing companies, so it very much is the manufactures.


I believe that remotely disabling your car if you don't pay has been an established practice among "buy here pay here" dealers for many years. It's an "innovative" way to lend to people who have bad or no credit.

On the other hand, I've never heard of it spreading outside that market segment.

It would be news to me if the major manufacturers finance arms have the capability and are keeping it on the down low.


What's really shocking is that this number is post provision for future losses, which is a non cash accounting charge that the media often uses to make banks look worse. These are real losses.


Wait to see what the realized losses are. Banks are kinda infamous for huge preemptive write downs, then discovering "profits" when the loans pan out.


I think it is that, I assume "money set aside to cover possible losses on loans" means income statement provision for future losses.


The retailers love it though.

I even Amazon is getting in on it.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: