Hacker Newsnew | past | comments | ask | show | jobs | submit | theodorejb's commentslogin

What benefit is an eye unless there is also the capability of processing and using the information? How would both evolve simultaneously?

A photosensitive patch of cells could be wired directly to motor cells/muscles on the opposite side, which would allow the organism to swim toward the light (maybe useful for feeding or migrating, etc.)

How would the photosensitivity and wiring to muscles come about at the same time?

The "wiring to muscles" is derived from the ability of adjacent cells to communicate by chemical signals.

This communication ability has evolved before the multicellular animals, in the colonies of unicellular ancestors of animals (e.g. choanoflagellates).

The intercellular communication is a prerequisite for the development of multicellularity, like a common language is a prerequisite for a group of humans to be able to work as a team.

In an unicellular organism, a part of the cell senses light and another part, like flagella or contractile filaments reacts, moving the cell. In a multicellular organism, a division of labor appears, the cells from the dorsal side of the animal sense first light and other stimuli from the environment, so some of them specialize as sensory cells. Originally, the cells from the ventral side were more effective for locomotion, by using either cilia or propulsive contraction waves, so some of them specialized for locomotion, becoming motor cells, either muscles or ciliary bands (which in many simple animals are more important than muscles).

With this division of labor, the older intercellular communication methods have been improved, resulting in synapses between the sensory cells and the motor cells, which ensure that a chemical message that is sent reaches only the intended recipient, instead of being broadcast into the neighborhood.

For better reactions to external stimuli, the behavior of the sensory cells had to be coordinated, e.g. even when light is sensed only on one end of the animal, for the entire animal to move an appropriate command must be sent to all motor cells, not only to some of them, which has lead to synapses between the sensory cells themselves, not only between sensory cells and motor cells.

Eventually, there was a further division of labor, a part of the sensory cells has specialized to be middlemen, i.e. to relay the sensory information between the cells that have actually received it and the motor cells. These third kind of cells have become neurons. Initially the neurons were in the skin, together with the sensory cells from which they had derived, but later they migrated inside the body, where eventually they formed ganglia instead of a diffuse net, because this minimizes the reaction times, by shortening the connections between neurons, leading to a centralized nervous system.


As long as a mutation isn't strongly maladaptive, it can evolve prior to its being useful.

They didn't need to come about at the same time. Photosensitive proteins (opsins) and cellular motility both predate multicellular life entirely. Even single-celled euglena detect light and swim toward it with no nervous system at all. In early multicellular animals, cells were already chemically signaling their neighbors. A photosensitive cell releasing a signaling molecule near a contractile cell isn't a coordinated miracle. It is just two pre-existing cell types sitting next to each other in tissue, which is what bodies are. Natural selection then refines that crude coupling because even a tiny, noisy light response is better than none.

Each piece, light-sensitive proteins, cell-to-cell signaling, contractile cells, evolved independently and for other reasons long before being co-opted into anything resembling vision. The question "how could A and B arise simultaneously?" dissolves once neither A nor B was new.


Stated clearly (0) has recently started a fantastic series about evolution that aims to explain bacterial flagella. It starts from basic principles and aims to answer questions like yours in evolutionary biology.

(0) https://m.youtube.com/watch?v=eFC9VzexRUk


A fairly simple chemical reaction could cause an organism to turn or move toward or away from light in the ocean, with various imaginable benefits.

And note that box jellyfish have 24 eyes, some of them highly complex, but no brain. You can look into their behavior to find out what they do with the information.


According to the timeline it took more than a week just for Filevine to respond saying they would review and fix the vulnerability. It was 24 days after initial disclosure when he confirmed the fix was in place.


Given that the author describes the company as prompt, communicative and professional, I think it’s fair to assume there was more contact than the four events in the top of the article.


My guess would be so they don't have to embed an IP address or hostname in the malware to send secrets to, which could then be blocked or taken down.


But they could encrypt it, its just double b64 encoded, everybody can read it.


That one stumped me. Why not just encrypt with a hardcoded public key, then only the attacker can get the creds.

The simple B64 encoding didn't hide these creds from anyone, so every vendor out there's security team can collect them (e.g. thinking big clouds, GitHub, etc) and disable them.

If you did a simple encryption pass, no one but you would know what was stolen, or could abuse/sell it. My best guess is that calling node encryption libs might trigger code scanners, or EDRs, or maybe they just didn't care.


Or they just wanted to prove a point.

They surely seemed to be smart enough to choose encryption over encoding.

Hard to believe encryption would be the one thing that would trigger code scanners.

Also it’s not just every vendor, also every bad actor could’ve scraped the keys. I wonder if they’ve set up the infrastructure to handle all these thousands of keys…

Like what do you even do with most of it on scale?

Can you turn Cloud, AWS , AI api keys to money on a black market?


Someone could be tricked into giving their npm credentials to the attacker (e.g. via a phishing email), and then the attacker publishes new versions of their packages with the malicious diff. Then when the infected packages are installed, npm runs the malicious preinstall script which harvests secrets from the new machine, and if these include an npm token the worm can see which packages it has access to publish, and infect them too to continue spreading.


I can testify that steamed stingy nettles with gomasio (toasted sesame seeds and salt) is very delicious.


One option to make it a little safer is to add ignore-scripts=true to a .npmrc file in your project root. Lifestyle scripts then won't run automatically. It's not as nice as Pnpm or Bun, though, since this also prevents your own postinstall scripts from running (not just those of dependencies), and there's no way to whitelist trusted packages.


Bun also doesn't execute lifestyle scripts by default, except for a customizable whitelist of trusted dependencies:

https://bun.com/docs/guides/install/trusted


"Trusted" dependencies are poor solution, the good solution is either never run scripts, or run them inside qemu.


I would expect to be able to download a package and then inspect the code before I decide to import/run any of the package files. But npm by default will run arbitrary code in the package before developers have a chance to inspect it, which can be very surprising and dangerous.


npm used to do that. bun never did. No idea about the past for pnpm or yarn.


> Human cognition was basically bruteforced by evolution

This is an assumption, not a fact. Perhaps human cognition was created by God, and our minds have an essential spiritual component which cannot be reproduced by a purely physical machine.


Even if you don't believe in God, scientific theories of how human cognition came about (and how it works and changes over time) are all largely speculation and good storytelling.


It’s not an assumption, it’s a viable theory based on overwhelming evidence from fossil records.

What’s NOT supported by evidence is an unknowable, untestable spiritual requirement for cognition.


What overwhelming evidence do fossil records provide about human cognition?


We don't need fossil records. We have a clear chain of evolved brain structures in today's living mammals. You'd have to invent some fantastical tale of how God is trying to trick us by putting such clearly connected brain structures in a series of animals that DNA provides clear links for an evolutionary path.

I'm sympathetic to the idea that God started the whole shebang (that is, the universe), because it's rather difficult to disprove, but looking at the biological weight of evidence that brain structures evolved over many different species and arguing that something magical happened with homo sapiens specifically is not an easy argument to make for someone with any faith in reason.


>clear links for an evolutionary path

there are clear links for at least 2 evolutionary paths: bird brain architecture is very different from that of mammals and some are among the smartest species on the planet. they have sophisticated language and social relationships, they can deceive (meaning they can put themselves inside another's mind and act accordingly), they solve problems and they invent and engineer tools for specific purposes and use them to that effect. give them time and these bitches might even become our new overlords (if we're still around, that is).


And let’s not forget how smart octopuses are! If they lived longer than a couple years, I’d put them in the running too.


> it’s a viable theory based on overwhelming evidence from fossil records

No one has gathered evidence of cognition from fossil records.


Sure they have. We see every level of cognition in animals today, and the fossil record proves that they all came from the same evolutionary tree. For every species that can claim cognition (there’s lots of them), you can trace it back to predecessors which were increasingly simple.

Obviously cognition isn’t a binary thing, it’s a huge gradient, and the tree of life shows that gradient in full.


It is completely unreasonable to assume our intelligence was not evolved, even if we acknowledge that an untestable magical process could be responsible. If the latter is true, it's not something we could ever actually know.


> If the latter is true, it's not something we could ever actually know.

That doesn’t follow.


It follows by definition. If the magic, spirit, or god were testable, it becomes a part of scientific theory.


I'm sticking to materialism, because historically all its predictions turned out to be correct (cognition happens in the brain, thought manifests physically in neural activity, affecting our physical brain affects our thinking).

The counter-hypothesis (we think because some kind of magic happens) has absolutely nothing to show for; proponents typically struggle to even define the terms they need, much less make falsifiable predictions.


it is an assumption backed by considerable evidence. creationism otoh is an assumption backed by superstition an phantasizing, or could you point to at least some evidence.

besides, spirituality is not a "component", it's a property emergent from brain structure and function, which is basically purely a physical machine.


In that sense, what isn't an assumption?


Maybe there's a small teapot orbiting the earth, with ten thousand angels dancing on the tip of the spout.


I think you’re both saying the same thing


Many people have non-JS backends and only use npm for frontend dependencies. If a postinstall script runs in a dev or build environment it could get access to a lot of things that wouldn't be available when the package is imported in a browser or other production environment.


Malicious client-side code can still perform any user action, exfiltrate user data via cross-domain requests, and probe the user's local network.


I wonder why npm doesn't block pre/postinstall scripts by default, which pnpm and Bun (and I imagine others) already do.

EDIT: oh I scrolled down a bit further and see you said the exact same thing in a top-level comment hahah, my bad


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: