MurphyA/hacker-news huggingface dataset:
by bostik | 2025-04-14 15:22:55+00:00
Some kind of additional leverage and/or connections were certainly used.

The open dirty secret of infosec is that outside of authentication systems, the products and services sold do not actually work. Usability and real world functionality are not box-tick items in feature matrix comparison. It is enough that a security[tm] product does something technically correct to get a green tick in the relevant feature list row.

As a result the products are not commonly sold to their end users. They are sold to C-suite, and inflicted upon their victims. And how do C-suite choose what vendor to throw their money at? DDQ/RFx templates. I wish I was joking.

The other dirty secret of infosec is that everyone does their vendor/client/etc. vetting with bingo sheets full of meaningless, context-free questions that try to enumerate SYMPTOMS of different kinds of breach scenarios - they do not attempt to look at root causes, and they certainly do not consider threat models. These bingo sheet templates are used by everyone: vendor teams, insurers, auditors, you name it.

And now we finally get to how Wiz pulling connections intersects with the above. A fair number of the bingo sheet templates come with pre-populated dropdown choices. The choices usually include no more than 8 options, including "Other". The implication is very clear: "if you use one of these known & approved vendor products, then we are fine with it".

Wiz got their offering included in the bingo sheet templates in approximately 18 months from launching publicly. That has provided them with constant advertising from the countless infosec questionnaires thrown around the various industries and the implied checkmark of being pre-approved as a vendor of choice. Given the landscape and the general quality of competing vendors, your product needs to be merely not-shit to stand out and get traction through the various back channels.

Now, from personal exposure I can say that Wiz's product (or at least those I have been faced with) are still better[ß] than their competition. A recent security scan report from a client using Wiz had only ~85% of false positives. The average FP rate for other vendors tends to be 95% or even higher.

ß: security products must be the only segment where vast majority of results being false positives is considered both acceptable and normal. In any other field a product that routinely gets >90% of its answers wrong would be consigned to rubbish heap.
by anenefan | 2025-04-14 15:23:04+00:00
https://archive.md/WSRF9

Well it's an interesting narrative Bayer are putting out. They have of a few years ago already trying to market the next generation of herbicide resistant seeds and matching herbicide. The patent has fallen off the early corn varieties that were roundup ready. It's been a while since I had a good look but at the time the big three herbicide companies were asking 3 to 5 times as much than the roundup on offer and IIRC, application had to be most particular to ensure near 100% coverage otherwise it might fail. I could be recalling a different herbicide so don't quote me on that.

The problem with it's removal from the market, many of the other herbicides have worse (if not far worse) health implications and some have woeful secondary and tertiary breakdown products which could impact organisms such as worms.

I am biased though, I'm all for Glyphosate as long as it's used appropriately, and not over used. The wetters (other components) in roundup have included definite carcinogens which really doesn't get much noise as the same family of chemicals was IIRC albeit in much lower concentrations, part of preparations typical in some women's beauty products. Roundup's formulation has changed quite a bit as well, the earlier stuff I had the misfortune of spraying it, landing a temporary job where the main task was spraying fence lines with a roundup mix from a tractor - and just a few drops of the diluted mix soaking though the long pants would give me a bad headache for the rest of the day and into the night. I am also for it that unlike many of the other common nasty herbicides, the worst that can be said is it might be carcinogenic. I have always been very wary of agricultural chemicals - esp too many scary stories regrading pesticides / insecticides. However as a young lad in the 70s, grew up beside a neighbour, an army vet who visiting the capital for cancer treatment was alarmed large proportion while he was there were cane farming people from our region also seeking treatment there - roundup hadn't really been greatly adopted at that point in time.
by donohoe | 2025-04-14 15:23:07+00:00
I was attending a conference last week with a mix of journalists and those adjacent to that space (editors, foundations, product, etc). Everyone is concerned about data security, but they are also concerned about the increase in device searches that has been reported (and often not reported).

Yes, this is nothing new. But the increase is new.

Anyone a visa is not in a strong position to decline. US citizens are expecting more scrutiny too.

The use of a loaner, burner, or second device means you can now decline with confidence (and just be delayed by several hours in a interview room and have your devices confiscated) OR you can allow the search and protect your privacy (the most likely best use-case for visitors).
by simonask | 2025-04-14 15:23:49+00:00
This comment makes no sense.

1. You have linked lists in Rust. They're in the standard library.

2. Linked lists do not have "unmatched performance" - they are slower than almost anything, outside of highly specialized use cases. Even moreso for intrusive linked lists. Worst of all, they are horrible for cache locality.

There are valid uses of linked lists, that's why they exist, but most people don't have those use cases.
by Workaccount2 | 2025-04-14 15:24:13+00:00
Lately I have been experimenting with ways to work around the "context token sweet spot" of <20k tokens (or <50k with 2.5). Essentially doing manual "context compression", where the LLM works with a database to store things permanently according to a strict schema, summarizes it's current context when it starts to get out of the sweet spot (I'm mixed on whether it is best to do this continuously like a journal, or in retrospect like a closing summary), and then passes this to a new instance with fresh context.

This works really effectively with thinking models, because the thinking eats up tons of context, but also produces very good "summary documents". So you can kind of reap the rewards of thinking without having to sacrifice that juicy sub 50k context. The database also provides a form of fallback, or RAG I suppose, for situations where the summary leaves out important details, but the model must also recognize this and go pull context from the DB.

Right now I have been trying it to make essentially an inventory management/BOM optimization agent for a database of ~10k distinct parts/materials.
by Aurornis | 2025-04-14 15:24:25+00:00
> to get protections from the law and guarantees, financial institutions need to get licensed and comply with all the rules, regulations and law.

That’s not how the law works.

If someone breaks the law or doesn’t comply with regulations, that’s a separate issue. It doesn’t entitle a third party to steal their funds.

If you were to rob a drug dealer, you couldn’t argue that they weren’t complying with the law and therefore you were free to take it. You would both have broken laws.
by erikerikson | 2025-04-14 15:24:25+00:00
> loss objective

There is no prediction or desired output, certainly explicit. I was playing with those things in my work to try and understand how our brains cause the emergence of intelligence rather than solve some classification or related problem. What I managed to replicate was the learning of XOR by some nodes and further that multidimensional XORs up to the number of inputs could be learned.

Perhaps you can say that PCAish is the implicit objective/result but I still reject that there is any conceptual notion of what a node "should" output even if iteratively applying the learning rule leads us there.
by whizzter | 2025-04-14 15:24:54+00:00
Agreed, going for a custom engine anyhow in my scenario so that's fine.

It seems that they're built to run serially to achieve reproducible simulations so my guess would be no, this is one thing my experiment does differently although formally it might just be a naming difference.

It's not a major issue though I think, the stuff I work on could shard work by area so single areas are single-threaded but world-wise it's parallel (Eve online has done this for ages).
by danielvf | 2025-04-14 15:25:38+00:00
The camera shows night in the Wild West.

A masked man creeps through the shadows of a sleeping town.

He looks both ways, then uses a knife to unlatch a door from the outside. He slips into near pitch blackness. He moves confidently in the darkness - he's worked for this bank before, checking on their security from theft.

Out comes his lock picking tools - the bank president's office door opens with a quick rake. Cheap lock.

Inside, with no windows to betray him, he lights a candle. There in the corner stands the safe. He knows it inside and out, and has been practicing. Five minutes later, the lock is picked, and he loads up the gold, cash, and bonds inside.

He puts the candle out, slips back outside, and returns to his room at the lodging house, climbing in through the window.

The next morning, with the discovery of missing gold, the town looks like someone kicked over a fire ants nest. It only takes 30 minutes before people start wondering about "bank security expert" who had just been in the bank every day.

A crowd heads over the boarding house, growing in size as it goes.

"Did you steal our money?", they ask?

"ABSOLUTELY NOT," he replies, "I merely used my immense mental powers to out hink several flawed physical security measures, breaking no laws of physics, in such a way that the gold, cash, and bonds previously belong to you are now in my possession, and now belong to me. No theft has taken place, only the movement of certain levers, of which anyone who knew how could move, and the movement of afterwords of certain goods."

"So you stole our money!!", the town shouted.

"No, no, I just interacted with the universe according to its very own publicly available rules. No theft has occurred!"

An old cowhand, covering him with double barrel, spoke up, "Walll, guess he's right. We deserved to lose all that money. He did nothing wrong at all."

Everyone left, impressed with his genius.
by jitl | 2025-04-14 15:26:58+00:00
Quickwit was bought by Datadog, so I feel there's some risk quickwit-oss becomes unmaintained if Datadog's corporate priority shifts in the future, or OSS maintenance stops providing return on investment. Based on the Quickwit blog post, they are relicensing to Apache2 and releasing some enterprise features, so it seems very possible the original maintainers will move to other things, and it's unclear if enough community would coalesce to keep the project moving forward.

https://quickwit.io/blog/quickwit-joins-datadog#the-journey-...
by 5evOX5hTZ9mYa9E | 2025-04-14 15:27:02+00:00
If you read the Linkding archiving page, you can see that it is possible to set up SingleFile extension to auto-snapshot the page when the page is added, from the browser you're using at that moment. The advantage is that loing is handled implicitly, but a disadvantage is that this only works in the browser, and not for example when you use the Android app. But for me that's fine,

Also, it is possible to configure SingleFile extension to automatically push a snapshot to a REST Form API. You can even make it do so when you bookmarks something in your browser, to achive a flow where bookmarking something in the browser saves the page via SingleFile extension and gives it to ArchiveFile.

https://docs.archivebox.io/dev/Contents.html#api-reference

Also, look in the SingleFile extension options, under Destination.
by unsupp0rted | 2025-04-14 15:27:04+00:00
Everything said to me in say taxi cabs, buses, or any places without the expectation of privacy being public would make everybody a lot more ostensibly conscientious. It would not only prevent crimes, it would make tracing criminals, solving crimes, and absolving the innocent much simpler.

There'd still be public crimes by idiots, drugs addicts, etc, of course, but the panopticon effect would prevent a huge chunk.

The trade-off is we'd have to teach kids from childhood the legal definition of a public place, which differs substantially from the "I'll make it up however I feel like" definition of a public place.

And conversely, anything said in private would have to be fiercely defended- far more than it is now.

Committing a random public crime should be as obviously a bad idea as climbing up on stage at a 10,000-person concert and committing the same crime in front of everybody.
by evanelias | 2025-04-14 15:27:38+00:00
Honestly it seems to have different new bugs every year. This year, it completely ignored income from a 1099-DIV imported from Vanguard. It shows the 1099-DIV as imported, and it shows the correct numbers on it, but just failed to add any of those numbers to the totals for dividends and distributions!

Apparently the work-around is to manually edit the form and enter 0.00 on any line the import left blank. After doing that, the software accounts for everything properly.

I found a forum post of TurboTax users discussing this exact issue with Vanguard 1099-DIVs back in January, and it still isn't fixed yet in April. Seems like this could affect a lot of people who just won't notice, because it isn't obvious unless you manually double-check the tax math.
by dcow | 2025-04-14 15:27:39+00:00
People aren’t saying the chance is literally zero. They are saying it is low enough that they can’t consider it reliable comp for income purposes in their own personal situations. I can’t say my experience has been any different so I don’t blame them. People commenting aren’t math illiterate. I’m kinda amazed you are taking things so literally when it’s so obvious to anybody reading how to interpret the discussion.
by neuroelectron | 2025-04-14 15:27:40+00:00
It reminds me of the Sam Bankman-fried case, but it also quite different. SBF thought the abstractions would protect him from the law when he clearly was misleading investors and using code to abstract away his fraud. However, in this case, the code/fraud was presented and used as intended. While I believe SBF was innocent of defrauding his early investors who were foolish to trust such a system, he was guilty for other reasons.

Andean Medjedovic's case shouldn't have even made it to court and he had no obligation to leave his crypto or cashed out legal tender with some "custodian" and spend the next several years of his life as a beta tester for establishing case law. This wasn't just "code is law," more accurately, "under the stipulations of the contract, code is law."
by soared | 2025-04-14 15:27:53+00:00
Props to the author for grinding through this, but I think a very strongly worded and formatted warning is needed at the top. Embarking on this trip with so little knowledge meant putting yourself far away from civilizations while criminally underprepared.

I love the energy of Supertramps, but there is a reason they are controversial. It would be very easy to make a mistake and be in big trouble - underestimating water needs in a barren stretch, a hole in your tire (not tube) and not knowing how to fix it, etc. it’s pure luck you didn’t not over exert a small muscle or ligament locking you out of cycling during recovery.
by lou1306 | 2025-04-14 15:28:31+00:00
No matter whether you are using C for "freedom" or "flexibility" of "power", 95% of the time you only need that in a very small portion of your codebase. You almost definitely do _not_ need any of that in, say, the logic to parse CLI arguments or config files, which however is a prime example of a place where vulnerabilities are known to happen.
by maleldil | 2025-04-14 15:29:01+00:00
> Go _is_ something of a sharp tool. Maybe we need to put a warning on it: for mature audiences only

This has been said for other languages, and it turns out no one is mature enough to consistently make it work without issues. The world has moved on; we can have proper tools that won't shoot your leg off.

Why risk misusing the sharp tool when you can just use something safe to accomplish the same thing?
by wofo | 2025-04-14 15:29:16+00:00
I've been pretty disappointed with eStargz performance, though... Do you have any numbers you can share? All over the internet people refer to numbers from 10 years ago, from workloads that don't seem realistic at all. In my experiments it didn't provide a significant enough speedup.

(I ended up developing an alternative pull mechanism, which is described in https://outerbounds.com/blog/faster-cloud-compute though note that the article is a bit light on the technical details)
by bmandale | 2025-04-14 15:29:21+00:00
A few notes I would make as an outsider:

- conventionally we put the `node' struct at the start of the `user' struct. The advantage is that we can convert from node* to user* with a simple cast instead of messing around with offsets. Knowing the offset stuff is still potentially useful in case you want multiple `node's in a single struct, but that is seldom the case so you can almost always get by with just a cast.

- this strategy is, especially with the node at the start of the user, equivalent to inheritance. I take it from the fine article that zig doesn't have inheritance? If they are planning on adding more interfaces like this linked list one, then inheritance would be a good idea. We often treat inheritance using analogies to the animal kingdom or to geometric shapes, but data structures like linked lists are (to my understanding) the problem that inheritance is actually designed to solve, and it is really the best approach to solving problems like in the OP.

- just lol on zig speed running being a crappier C++.
by BlackFly | 2025-04-14 15:29:30+00:00
He should have accepted their offer of 10% as a bug bounty. Certainly crypto folk love to act like unregulated markets but this smells like market manipulation to my armchair education and even if the market tries to play both ways, the courts won't. I do hope that the Ontario court fights the extradition, because the American laws leveled at him seem bogus by Canadian standards (wire fraud, extortion and money laundering) but that tort case might be legit.
by ForOldHack | 2025-04-14 15:29:53+00:00
The TV show, in it's absurdity, pointed me to the radio show, which I adored, which led me to read all the books, so when the game came out we laughingly struggled with it, for months, until the sales guy at egghead gave us just a few hints...

A dacade later, ztools was able to read it's dictionary, and people would ask what it was all about... We distributed libraries on bbses, Napster, all manner or ways to get the media out so people could laugh... And most of them found their way back to the Adams books and recordings. We never distributed the books, unless the 2nd half was deleted... ( Waldens, which was beside Egghead, would to though spurts where Adams books would make the best sellers lists, and fade, and enjoy multiple resurgences. )

Go and buy the books (Douglas Adams) and use them for gifts.
by dcow | 2025-04-14 15:30:18+00:00
It’s not importantly different if the value you get from pre-IPO equity is less that the haircut you took to work at the startup, which is overwhelmingly the case.

You want to tell me you’d be feeling like your equity was worth something in colloquial terms if you got what amounted to a mediocre bonus one year through your liquidity event?
by kens | 2025-04-14 15:31:25+00:00
Coincidentally, I'm reading Walker's book "Life as No One Knows It: The Physics of Life's Emergence" on the same topic. (Walker is one of the researchers in the article.) Summary: I don't like the book. The book was motivating me to write an article "Books I don't like", but I'll comment here instead :-)

The book describes "Assembly Theory", a theory of how life can arise in the universe. The idea is that you can quantitatively measure the complexity of objects (especially chemicals) by the number of recursive steps to create them. (The molecule ATP is 21 for instance.) You need life to create anything over 15; the idea of life is it contains information that can create structures more complex than what can be created randomly. The important thing about life is that it isn't spontaneous, but forms an unbroken chain through time. Explaining how it started may require new physics.

If the above seems unclear, it's because it is unclear to me. The book doesn't do a good job of explaining things. It looks like a mass-market science book, but I found it very confusing. For instance, it's unclear where the number 21 for ATP comes from, although there's an analogy to LEGO. The book doesn't define things and goes into many, many tangents. The author is very, very enthusiastic about the ideas but reading the book is like looking at ideas through a cloud of vagueness.

The writing is also extremely quirky. Everyone is on a first-name basis, from Albert (Einstein) to Johnny (von Neumann) and Erwin (Schrödinger). One chapter is written in the second person, and "you" turn out to be "Albert." The book pushes the idea that physics is great and can solve everything, covering physics "greatest hits" from relativity and quantum mechanics to gravitational waves and the Higgs boson. (The underlying theme is: "Physics is great. This book is physics. Therefore, this book is great.") The book has a lot of discussion of how it is a new paradigm, Kuhn's paradigm shifts, how it will move astrobiology beyond the pre-paradigmatic phase and unify fields of research and so forth. It's not a crackpot book, but there are an uncomfortable number of crackpot red flags.

I'm not rejecting the idea of assembly theory. To be honest, after reading the book, I don't understand it well enough to say which parts seem good and which parts seem flawed. There seem to be interesting ideas struggling to get out but I'm not getting them. (I don't like to be negative about books, but there are a few that I regret reading and feel that I should warn people.)
by myfonj | 2025-04-14 15:31:27+00:00
> "We can expect the carbon pool stored in these forests to increase substantially,"

Interesting. I would have guessed that any kind of forests have quite limited cap how much carbon it could retain in dead wood, and that this cap will be pretty much fixed. Unless something will stop natural decay processes releasing the carbon back to the atmosphere I don't see how existing grown forest could increase its capacity, since I suppose it is already at its equilibrium.

(Unlike peatlands, where most of accumulated carbon remains underwater, so it presumably has much larger capacity.)

Simply said, without "burying or sinking wood mass" I see no easy way to prevent carbon from returning into the atmosphere. Basically if we need to take carbon from the atmosphere, we should ideally put it back from where we have been mining it for last couple of centuries.
by adornKey | 2025-04-14 15:31:29+00:00
CIEXYZ (CIE 1931) had the best brightness axis ever. But the hunt for the best color-axis seems to be ongoing. CIE 1960, CIE 1964, CIELAB/CIELUV 1976...

CIECAM02 CIECAM16 seem to be new iterations. Maybe those are good now?
by paulnovacovici | 2025-04-14 15:32:05+00:00
Curious, how come you decided to use a cloud solution instead of hosting this on a home server? I’ve recently bought a mini PC for small projects like this and have been loving being able to host with no cost associated to it. Albeit it’s probably still incredibly cheap to use a IaaS or PaaS but still a barrier to entry for random projects I want to work on a weekend