For the best experience on desktop, install the Chrome extension to track your reading on news.ycombinator.com
Hacker Newsnew | past | comments | ask | show | jobs | submit | history | more ustad's commentsregister

“The locations were downloaded from a database maintained by the Korean National Police Agency.”


Whats that doing? I get some error about some gallery???


Has someone done this for MySQL?



Hey, that looks great.

Could you describe more about the docker sandbox that you have? I am especially interested in the network restrictions.


The sandbox is a lightweight Alpine-based container, it runs as a non-root user for security, it has minimal dependencies installed (curl, bash, coreutils)

The container has restricted outbound access—only HTTP/S requests are allowed. It runs inside an isolated network namespace with no access to the host network or other infrastructure components. There's no inbound access, and the container can't receive unsolicited requests from the outside world.

The sandbox container can only communicate with other containers in the same network, the main application container and sandbox container are on the same network, allowing them to communicate.


Thanks for the details!

Do you think there could be ways for someone to abuse the network setup you have?

For example, accessing other internet hosts or other containers in the same container network?

What happens when curl gets redirect responses?


Does anyone know if pandas is affected? I serialize/deserialize dataframes which pandas uses parquet under the hood.


Pandas doesn't use the parquet python package under the hood: https://pandas.pydata.org/docs/reference/api/pandas.read_par...

> Parquet library to use. If ‘auto’, then the option io.parquet.engine is used. The default io.parquet.engine behavior is to try ‘pyarrow’, falling back to ‘fastparquet’ if ‘pyarrow’ is unavailable.

Those should be unaffected.


Python pickles have the same issue but it is a design decision per the docs.

Python docs > library > pickle: https://docs.python.org/3/library/pickle.html

Re: a hypothetical pickle parser protocol that doesn't eval code at parse time; "skipcode pickle protocol 6: "AI Supply Chain Attack: How Malicious Pickle Files Backdoor Models" .. "Insecurity and Python Pickles" : https://news.ycombinator.com/item?id=43426963


But python pickle is only supposed to be used with trusted input, so it’s not a vulnerability.


https://www.endorlabs.com/learn/critical-rce-vulnerability-i...

> Any application or service using Apache Parquet Java library versions 1.15.0 or earlier is believed to be vulnerable (our own data indicates that this was introduced in version 1.8.0; however, current guidance is to review all historical versions). This includes systems that read or import Parquet files using popular big-data frameworks (e.g. Hadoop, Spark, Flink) or custom applications that incorporate the Parquet Java code. If you are unsure whether your software stack uses Parquet, check with your vendors or developers – many data analytics and storage solutions include this library.

Seems safe to assume yes, pandas is probably affected by using this library.


The paragraph you pasted in states that only applications importing the Java library are vulnerable.

Isn’t pandas implemented in Python/C? How would it have been importing the Java library?


I'm sorry. I made a mistake.


That does not follow for me. Pandas does not utilize Java/JVM.


I'm sorry. I made a mistake.


Well, you know, I see what you’re saying about Yoko - she’s not the kind of artist that makes your jaw drop or blows your mind with technique. But, to me, it’s not really about that. It’s about the journey, not the destination, right? Art’s all about the path you take, the experiences you collect, and the way you view the world. Yoko, for all the criticisms, has certainly led an interesting life, no doubt. She’s been a trailblazer, or maybe just a wild spirit, pushing boundaries and breaking norms. She’s had her share of ups and downs, but it’s the living that matters. And through it all, she’s remained true to herself. That’s something to admire, even if you don’t agree with everything she does. The destination, the fame, the recognition - that’s all fleeting. But the journey, man, that’s where the real magic happens.


> she’s not the kind of artist that makes your jaw drop or blows your mind with technique.

But to be displayed in MoMA she'd kind of have to be.

> Art’s all about the path you take, the experiences you collect, and the way you view the world.

I guess I see your point, the fact that she is the widow is also part of the artist and the artwork. That's fair. But, I'll also say that who she is is the 90% part and the 10% is the art. If one anonymized her work, it would never have made it to those galleries or exhibits.


That's underselling her influence as an artist from her pre-Beatles period. She produced a handful of important avant-garde pieces and performances from the 60s in NYC and London and was a student and collaborator of John Cage, an extremely influential composer who has had dozens of exhibitions at MoMA. In fact she first met The Beatles to request a song manuscript for a Cage book.

She was also well connected to that world (she was invited to join the Fluxus community and artists like Marcel Duchamp attended her NYC loft parties) and quite ambitious, so there's a non-zero chance she would have become even more prominent had The Beatles association never taken place.

I have no interest in that world myself, but to say she was a nobody without The Beatles simply isn't true, she was definitely a rising star. A household name? Probably not, but possibly. An artist from that period that could be exhibited at the major international galleries, have her works studied in art schools? Absolutely.


Yeah. I can agree about her 60s work.

However I think she would have stayed relatively obscure had she not become "ultimate professional widow" as the article put it.


> But to be displayed in MoMA she'd kind of have to be.

While I agree with you about Ono’s art, I disagree on this. I know art is subjective, but in my times at MoMA I’ve found it bimodal: works on display there either blow ls my mind or I just don’t feel anything about.


You’re right that dietary changes can impact health, but there are other factors at play. Stress from moving to a new country or experiencing forced dislocation can have serious effects on physical health, weakening the immune system and disrupting overall well-being. Along with this, shifting away from nature-based vocations to more sedentary lifestyles contributes to health decline. The increased consumption of sugar and alcohol also exacerbates dental and general health issues. So, it’s not just diet but a combination of stress, lifestyle changes, and modern substances that contribute to health problems in these populations.


Its funny to read negative replies to your comment on the shortcoming's of web apps.

The browsers are controlled and manipulated by the likes of Apple and Google. These companies have a significant influence on the direction of browser features and limitations, often shaping them to suit their business interests. For example, Apple’s Safari and Google’s Chrome have been criticized for implementing features that reinforce their own ecosystems, such as limiting web push notifications or restricting certain web API functionalities to encourage users toward their native apps. This ultimately means that even in the browser world, the same forces that drive the app store monopolies can still control and restrict what’s possible, even if the web is inherently more open. So while web apps offer more flexibility than native apps in theory, the reality is that Apple and Google’s control over the browsers still limits the true potential of a completely open web.


> The browsers are controlled and manipulated by the likes of Apple and Google.

Who do you think controls Android and iOS native APIs?

Web standards at least have public forums and specs, with multiple parties involved. And all the major browser engines are open source and apps built for them are relatively cross-compatible.


Using AGI in the titles of your tests might not be accurate or appropriate. May I suggest NAI - Narrow AI?


My prediction: we'll be arguing about what AGI actually is... Forever.


Or depending on your outlook, for a couple of years, and then we will no longer be participating in these or any other cognitive exercises.


I have a static IP far from China. The original search and screenshot had my region selected - with same search results. I changed it for privacy.


Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search:

HN For You