For the best experience on desktop, install the Chrome extension to track your reading on news.ycombinator.com
Hacker Newsnew | past | comments | ask | show | jobs | submit | history | nrmitchi's commentsregister

It’s a supply and demand thing. Google would definitely be buying from nvidia and setting up themselves if nvidia had the capacity.

SpaceX/xAi/musk are currently in a good market for “happening to own 100k cards we have nothing to do with”, and are exercising that control as hard as they can.


IIRC the large majority of their hardware (at least one tranche, they might have gotten more later) was Elon effectively stealing it from Tesla for xAI, saying “I’m personally doing Tesla a favor, since they can’t fully utilize it currently”, and is now renting that (stolen) compute to subsidize SpaceX.

Musk is a walking and talking financial fraudster and criminal and somehow keeps getting away with it.

Someday, Americans may punish him with a presidency.

> doctrine of consular nonreviewability protects any denial from judicial review, and there is no administrative appeals process.

I personally think this is the big secondary benefit that the administration is going for.


It is absolutely NOT specific to the very limited situation you are describing, which is already a big red flag when processing applications.


"USCIS acknowledges exceptions including nonimmigrant categories with dual intent and immigrant categories where only adjustment of status provides a pathway to permanent resident status"

https://www.uscis.gov/sites/default/files/document/memos/PM-...


The literal next line after your quote is:

> While aliens who were inspected and admitted or paroled may request adjustment of status, as a general matter the discretionary approval of such a request is extraordinary given Congress’s intent that aliens should depart once the purpose for which they sought parole or nonimmigrant admission from DHS has been accomplished.


There is no carve out in this memo that says it’s only for B1/B2. Or that K-1 is excluded.

An entire visa class is not “obviously an exception”, or it would be clear.


I’m also pretty sure you cannot apply for an AOS from a B1/B2 to a green card.

I think you can apply for an AOS to a different dual intent visa which could then allow you to apply for a green card if you meet the requirements for that visa.

Maybe something like if you get married while visiting, but even then I believe you need to apply for an adjustment of status to a marriage visa and then apply for a green card.


No. Before you could enter on a tourist visa and there was an automatic presumption of fraud if you got married, etc within the first 90 days, but you could get married after 90 days, but before 6 months of maximum tourist stay and they may investigate a little bit, but it was generally not difficult.

The IR-1/CR-1 that you describe is how a spouse would apply from outside the country.


These are great improvements, it's good to see Apple investing in improvements like this (especially with the Vision Pro) but I can't help but feel that they utility will remain very low until they make the Vision Pro look significantly less distopian than it does.

The form-factor is a significant issue for real-world usage, and it's kind of unclear if there is a plan for a future product line given its (pretty abysmal) initial receiption.


I don’t think abysmal is the right word. The hardware was widely praised except for being dorky looking and a few other complaints.

The price and lack of content and developer interest have been the main problems.

And ultimately, people just don’t seem that interested in this product category. Meta ran into the same issue, though at least they targeted gaming where there is a decent niche.

VR/AR tech seems cool and futuristic, but hasn’t quite found its killer app yet.


Meta did sell over 20 million headsets. The Quest is definitely lower-margin hardware than Vision Pro, but in terms of install base that's an order of magnitude larger audience.

Apple really screwed themselves by only supporting WebXR for cross-platform VR experiences. Soon Valve will ship the Steam Frame, which will likely cost a fraction of the Vision Pro and support bog-standard PC games like H3VR, flight simulators and flatscreen PC titles. Meanwhile, AVP owners will have paid $3,500 for a more powerful chip/headset with a fraction of the content library and featureset that Valve and Meta offer. Vision Pro's lack of audience is entirely a self-imposed failure, it seems.


Yeah, the gaming market is a decent sized market. It’s not huge, though, and is not growing very fast.

It was a strategic mistake for Apple to not focus on gaming. But realistically, the AVP was always going to be way too expensive for basically anything.

Maybe if you could pick one up for like $800 and there was a lot of great 3D immersive content, it could take off. But even then, I feel like it’s just not a product category the average person is that excited about.


I completely agree with the outlook, but from a practical standpoint (in the last couple of years) I have seen the opposite. The SOC2 process is often transformative ("should" vs "is" are not the same thing).

Especially smaller startups, who grew somewhat quickly, and now "want to get SOC2 because customers want it". In practice this also (often, unfortunately) means "not all employees should have AWS admin creds, we should have some separation between environments, and we should know who has access to what".

For these companies SOC2 "requirements" can be the business-value line item that can get proper security and access-control patterns in place.


This whole story is just line after line of utter incompetence.

The "after they were fired" sounds catchy, but isn't even the biggest failure.

This organization shouldn't be permitted anywhere near government, or any non-public, data/information.


Appreciate the tanstack postmortem, however the security issue as far as the rest of the npm ecosystem goes is still an ongoing concern, correct?

Is there evidence that any downstream packages that may have pulled/included tanstack packages should be considered safe?


NPM is getting all the attacks and attention because it is the biggest. But there's nothing language specific to this class of attacks.


Yes, that is clear. But in this particular instance the tanstack packages are downstream of a ton of other packages.

Tanstack infected a bunch of other packages; then resolving their issue doesn’t fix the widespread issue


So what if they’re the biggest? They haven’t taken any meaningful steps to stop these attacks. The primary culprit for the sorry state of the npm ecosystem is npm inc, or actually their corporate overlord microsoft. They could be doing a lot more than they are.

I’m sort of reminded of how back in the day windows was swiss cheese and people kept saying “it is because they’re the biggest”, and then microsoft started caring about windows security and it improved enormously. When will microsoft start caring about npm security?


Yes.


No, it won't. All the "news" about that at the end of last year was 100% nonsense, started by tech "influencers" who cited nothing and showed nothing.

https://lifehacker.com/tech/meta-is-not-scraping-dms-to-trai...


what has meta ever done that would instill trust in you? From the very article you cited:

> The best thing you can do to preserve your privacy and security with your Meta messages is to use end-to-end encryption (E2EE) whenever possible. WhatsApp has E2EE built-in, and Meta has automatically started rolling it out for Messenger, but you might need to manually start an E2EE chat for existing conversations in the app. The same goes for Instagram: Meta offers E2EE, but you need to enable it yourself. In either app, tap the name of the chat to check whether or not that conversation is currently E2EE.


I didn't say that I trust Meta. My point was that saying they're doing it so they can read your messages just means that the people commenting don't know how E2EE works, or how it is still not a 100% secure way of communicating, just a more secure way of communicating. Once one of those ends is compromised, it's game over.

I really don't understand what the point of the quote you're citing? Or how it goes against what I was saying?

The best thing you can do would be to use E2EE. That would be the most secure thing. It won't, however, prevent the makers of your E2EE product from reading the messages once they're unencrypted, regardless of who makes it.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search:

HN For You