~hackernews | Bookmarks (11814)

Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

stepsecurity.io

We are actively investigating a critical security incident involving the tj-actions/changed-files GitHub Action. While our investigation...
We are actively investigating a critical security incident involving the tj-actions/changed-files GitHub Action. While our investigation is ongoing, we want to alert users so they can take immediate corrective actions. We will keep this post updated as we learn more. StepSecurity Harden-Runner detected this issue th...
2
Open source payments and billing infrastructure

github.com
1
Ask HN: What do you use to create diagrams?

ycombinator.com
1
A Proof of the Collatz Conjecture

arxiv.org
1
Transformers Without Normalization

jiachenzhu.github.io
1
Some Geniuses Are Swapping 200-Mile Battery Packs into BMW I3s

theautopian.com

BMW sold over 250,000 i3s between 2013 and 2022, and with those cars having carbon fiber...
BMW sold over 250,000 i3s between 2013 and 2022, and with those cars having carbon fiber bodies and aluminum frames that don’t rust; plastic and carbon fiber panels that don’t dent; and interiors that hold up to abuse, there are naturally many i3s still on the road, looking good. The issue is that many of these cars...
1
Carmakers Are Reinventing the Gear Shifter and Drivers Are Lost

wsj.com
1
How to Use a TPM on Linux

github.com
1
The Ozempocalypse Is Nigh

astralcodexten.com

Three GLP-1 drugs are approved for weight loss in the United States: Semaglutide (Ozempic®, Wegovy®, Rybelsus®)Tirzepatide...
Three GLP-1 drugs are approved for weight loss in the United States: Semaglutide (Ozempic®, Wegovy®, Rybelsus®)Tirzepatide (Mounjaro®, Zepbound®)Liraglutide (Victoza®, Saxenda®)…but liraglutide is noticeably worse than the others, and most people prefer either semaglutide or tirzepatide. These cost about $1000/month...
1
Experts warn about the 'crumbling infrastructure' of federal government data

npr.org

The stability of the federal government's system for producing statistics, which the U.S. relies on to...
The stability of the federal government's system for producing statistics, which the U.S. relies on to understand its population and economy, is under threat because of budget concerns, officials and data users warn. And that's before any follow-through on the new Trump administration and Republican lawmakers' pledg...
1
Show HN: Online Python Compiler with Libraries

cliprun.com
1
Show HN: eli – Embedded Lisp Interpreter

github.com
1
The court rejects Elon's latest attempt to slow OpenAI down

openai.com
1
Latin and the Big Questions

thecatholicthing.org
1
Optifye.ai (YC W25) Is Hiring

ycombinator.com
1
RubyLLM: A delightful Ruby way to work with AI

github.com
2
Google Being Forced to Sell Chrome Is Not Good for the Web

chriscoyier.net
1
Is God a Mushroom?

longnow.org

culture environment history interspecies ecologies psychology
1
How many eggs can you send? U.S. asks countries to help lower soaring prices

reuters.com
1
Gödel, Escher, Bach, and AI (2023)

theatlantic.com

bach’s ingenious use ideas johann sebastian bach novel idea whimsical dialogues
1
'Once in a Century' Proof Settles Math's Kakeya Conjecture

quantamagazine.org

Consider a pencil lying on your desk. Try to spin it around so that it points...
Consider a pencil lying on your desk. Try to spin it around so that it points once in every direction, but make sure it sweeps over as little of the desk’s surface as possible. You might twirl the pencil about its middle, tracing out a circle. But if you slide it in clever ways, you can do much better. “It’s just a ...
2
An Egyptian Temple Reborn

archaeology.org
1
From QED to Neovim

l-o-o-s-e-d.net

code culture
1
Popular GitHub Action tj-actions/changed-files is compromised

semgrep.dev

Popular GitHub Action tj-actions/changed-files has been compromised (GitHub issue) with a payload that appears to attempt...
Popular GitHub Action tj-actions/changed-files has been compromised (GitHub issue) with a payload that appears to attempt to dump secrets, impacting thousands of CI pipelines. This isn’t the first security issue with tj-actions/changed-files—see prior vulnerability CVE-2023-51664.What you should doStop using tj-acti...
1