skysight-inc/HackerNews huggingface dataset:
Lennart Poettering has replied on Reddit.

https://www.reddit.com/r/linux/comments/54yfcd/how_to_crash_...

> So let's summarize this. There's a bug in some software. OMG! Shock! This of course never happened before!

> The bug is in not exploitable remotely. The bug does not allow privilege escalation nor insertion of code. This of course makes the bug a massive vulnerability like there was no other on the planet ... ever. As bad as heartbleed multiplied by the Debian OpenSSL random generator bug to the power of 10.

> The bug is caused by an error check that filters out garbage sent to PID 1. The check works correctly, except that the resulting action is a too harsh: instead of complaining and dropping it will abort the process. Such a bug is of course unprecedented and the authors of said software should be stoned and flogged right away given the severity of the issue: after all a safety check worked a bit too well, and we really can't have that because undefined behaviour of course would be a lot better than a local DoS.

> The project the error was found in is large. Yet the number of CVEs collect so far is pretty small comparing it witht other projects of similar extent. Given that another bug was discovered now this obviously shows how incompetent the programmers are and that security is a unknown concept to them.

> The program the bug was found in is longer than 50 lines of code but runs with privileges, all written in a low-level programming langauge that many call little more than a fancy macro assembler. The code runs on top of an operating system kernel written in the same language but running with a lot higher privileges and consisting of expoentially more lines of code including drivers of questionnable quality. This together is of course proof that the project at hand is flawed conceptually to its core.

> Dha!

> Lennart

> (More seriously: yes this is a bug, we should fix it. But it's very low impact and the bruhaha it generated appears wildly out of scale. If all bugs in the wider Open Source ecosystem would have a similarly low impact we'd live in a much much safer world!)
Thanks for the links. I know in the US patenting an algorithm is legal but this is not the case in Europe where patenting any software is not legal. If this was the case I wonder why streaming services based in Europe such as Spotify or Soundcloud don't offer it considering the algorithms are well known.
Thanks! Glad you liked it. It's always been a frustration of mine (even reading / writing academic papers) when the author obfuscates or makes something more complicated than it needs to be.

You only truly understand something when you can explain it in lay (or close to) terms, I find.
Hm. perhaps I was unclear. Money is abstract in the same way voltage and current and frequency are abstract - you can't touch or grab a Hertz.

In the same way voltage, current and frequency have units of measurements (volt, amp and hertz), money has varying units of measurements too (American Dollars, and over here in Oz we have our own Dollaridoo)
Venture Capitalist Threatens to Quit If Taxes Are Raised
By default rotation is turntable, it has been like that for 4-5 years now. Also on startup you have a drop down menu to select Maya/Max hotkeys (but that's not enough because the UI is not Maya/Max).

I don't think that's really the problem. Switching to left click to select by default and having box selection and other common UI expectations would help. But also there's a mind set of "blender is awkward". I find it fast and fairly consistent, but only after having spent time learning it.

ZBrush on the other side, never stops being awkward to me.
Keep seeing stuff related to bluetooth which only makes sense for mobile. Anything new on apk nightlies? Rustup with androideabi is a good sign.
The /mod/ directory for the blitzmax programming language contain the source for all its modules and will be a good read

https://github.com/blitz-research/blitzmax/tree/master/mod
SaltStack has an agent that communicates with a master on a different server. The agents on the clients don't need an open port (other than egress).

This allows me to have one central server that is well secured and protected that allows ingress from the remote hosts, and then all the clients reach out to the master to get their tasks.
Blender can do a lot, but I really hate the interface. I'll stick with C4D.
The Removed Project
It sounds as though the code for plain old ALSA is still there though, so if you're building from source you can still enable it

...phew!
Former IC attorney admits NSA was wrong to spy on US persons
Well, if a government wants to place essential services on the internet (what is great, by the way), it must get enough redundancy to ensure the internet keeps working when something bad happens (what is a great thing to do by itself, by the way).

People assume they can just run essential services over untrusted infrastructure and "everything will be ok!" "look how much we are saving!". That's stupid, and this level of stupidity coming from any high administrator is unacceptable.

But, anyway, I can not believe a country can not live with its bureaucratic engine stopped for a couple of weeks. Yes, some important things will be late, but nothing that urgent should be demanding bureaucratic decisions, because those aren't really that fast. The physical protests must be much more worrying.

Just as a last note, it's borderline absurd that ISPs accept that their users forge other ISPs addresses. We badly need some international regulation on this matter - but instead governments are busy negotiating TPP and similar treaties.
Min_fgrep: minimal fgrep command in D
Awesome!

I have been using nude.js to do this ( http://s.codepen.io/icodeforlove/debug/gMrEKV ), which is hit or miss.
I think you just described ActiveX.
actual paper here:

https://news.ycombinator.com/item?id=12602633
Yeah, my CS 101, well, my college CS 101 I actually skipped, but it consisted of programming a robot in Python. My high school CS class was the AP CS AB preparation, i.e., Java with objects.
If the underlying cause is fraud, then making the tool available will only help the fraudsters cover up their mistakes.

I know they didn't talk about fraud in the article, but that was what this method was developed to detect: https://medium.com/@jamesheathers/the-grim-test-a-method-for...
[deletion because HN doesn't have strikethroughs for dramatic effect]

In which our complainant learns to read.
Raise State Gas Taxes (and not just for the money)
It is based on well-known histogram algorithms, there are several links in this discussion :)
Good god. So the project was already unmaintained, and now they're dropping it in favour of a maintenance burden, all the while regressing from a JS solution to a plugin-based native one?

I was wrong, Mozilla isn't in a free-fall. They hit the ground and are now digging the grave to bury themselves in.
The Berlin Hauptbahnhof is good looking with good functionality. I was there recently and it looked like there was a new phase of construction starting, its also visible in the aerial shot in on one of you links. Any idea what those plans are?
I intend to, and do as much to that end as my current situation allows. The barriers currently are largely wanting to be sure I have enough saved up that my family won't suffer if I end up failing. I market side projects during my personal time, and am constantly looking for opportunities on my own outside of a formal work career progression.

Do not take my earlier comment to mean I simply complain and languish; merely why there might be a natural frustration to some of the judgments/environment/deifying surrounding leadership positions (notably for my argument, bigCo leadership)

(To add another point I was nervous to say since it sounds arrogant; but I've ostensibly managed at a comparable scale to what some of the positions I'm aiming for would require, but in situations that don't hold the same level of credential-ism/tenure focus. This just adds to the open question in my mind of why those teams were able to find success with less rigid progression while others offer so much resistance. I mention this not to humble-brag but again, to point out mental dissonance.)
It says ChromiumOS, which amusingly, is the same base as CoreOS.
Having gone to a relatively selective institution, that was definitely my impression of the place...
You should probably stop making assumptions as to why people do (or do not) make a choice. Ideological rationalization on your part does not create motivation for someone else.
This is a profound misunderstanding of corporate governance, and the fact that so many people here somehow agree with the assertion that CEOs are paid for luck is astounding.
it's an unbelievably bad interface, I mean to the point that it's unbelievably bad even for experts [EDIT: for the sake of the thread I'll keep this, but I shouldn't speak for "experts" - only myself and the days I poured into it.] It's not about being, erm, "differently intuitive", or requiring learning - it's simply broken. Imagine if while you were typing into this text box (as I am) the cursor would randomly move up a line, down a line, right a character or left a character and you had to manually put it to where you wanted the next character to go - the cursor didn't stay at the end of the line you were typing, as one might "expect". (This is just an analogy for nothing working the way anyone might reasonably use it.)

That's how broken blender is. It's hideously painful. If this text box were Blender, it would have taken me about 148 minutes to type this reply, with a random adjustment or undo or redo every letter of the way, I would have been fighting with this text box the whole way.
Google Groups is such a lousy product these days. It uses stupid shebang-URLs, it requires you to sign in to view anything... but in signing in it forgets which URL you were trying to visit and dumps you back on the homepage.

It's a pretty good case study in why rebuilding your product entirely in JavaScript isn't necessarily a good idea.
Call a function named in a string variable in C
Or compare it to Silo, probably my favorite simple modeler. The user interface has scared me off Blender immediately.
Great post! Enough substance here to fund the search for startup ideas
To add to this: every serious production system tends toward a slurry of 2NF-3NF-BCNF models, mostly for performance reasons. The case of lastMessageTime is a simpler one, as it might drift out of date but generally you get false positives but never a false negative. Note that people complain about Facebook message jewels showing up when there's nothing new but seldom complain about not getting notified.

Another curious example is columnar databases. They are basically a 4NF storage layout with a veneer of 3NF syntax for ease of querying.
and if my change affects two hundred files, across dozens of directories?
A lot of those sound like good proxies for technical debt too.
ProxySQL has a mirroring feature that can act like a trigger on a separate thread: https://github.com/sysown/proxysql/blob/master/doc/mirroring...
Add a cronjob to refresh results if you are worried about skews over time.
Problem solved.
> I don't think it is for the tunnel alone. I think it is for all of the other work like a transit yard, more train carts, better train communication, more maintenance faciliities, etc, that boosted the price to $16b.

I stand corrected - the latest official word from Amtrak is $23.9 billion for the entire Gateway project, of which $7.7 is specifically for the tunnel (not including track work that's necessary to link it with Secaucus and Penn Station).

That's just the current projected cost. East Side Access was projected at $4.3 billion, but will end up costing more than $10.8 billion.
> Many people complain that Git is hard to use.

Really? Do people think that?
Google Container Engine Now on Kubernetes 1.4
I think it just proves your point: Victoria Underground Station is considered overcrowded, and is being upgraded at the moment with the construction of additional entrances.

It looks like everything new will be underground, so there's not so much room for beauty. Unlike my memories of NYC, it will at least be very well lit and kept clean.

https://tfl.gov.uk/travel-information/improvements-and-proje...

https://en.wikipedia.org/wiki/London_Victoria_station#Curren...
Sad that it has 57 issues and 27 pull requests, and begins with When you just press "g" the browser receives the event and the entire auto-complete machinery kicks into high gear... ... not exactly a low level explanation.

I was expecting non-keyboard input methods, keyboard scan codes, keymaps, input modes, fonts, glyph selection, screen resolution and rendering. Scan codes are mentioned in the next paragraph, but the rest are ignored (OK, they finally mention DOM rendering, but leave out the earlier screen updates). Two seconds later they are discussing ARP... really? What about virtualization, sandboxing, firewalling, link layer selection, use of multiple concurrent link layers for a given network-layer address range, non-ARP link layers, existing transport-layer sessions to the relevant hosts, VPNs, proxies, offline mode, caches and load balancers (possibly multiple layers), non DNS-based name resolution, differences between available IPv4 and IPv6 address classes (mobile IP), layer 2 transparent proxying (eg. proxy ARP/heartbeat), switch ARP caches, etc.

I also think this is an excellent interview question for any internet-related engineering role, as it really gives people a chance to show their degree of comprehension of many layers.
Not sure that Google would agree. Looking to Google's own words about open sourcing the project:

"We hope to build an active open source community that drives the future of this library, both by providing feedback and by actively contributing to the source code."
How is sound handled on FreeBSD? Or is FreeBSD going to be required to port and ship PulseAudio?
Top Tips for Negotiating Your Freelancer Contract
PDF.js doesn't support PDF forms, while PDFium does. Like Shumway and Flash, the long-tail of PDF compatibility is a lot of work spent on something that is not part of the Web.
GitLab is 30k+ lines of Ruby code http://gitlab-org.gitlab.io/gitlab-ce/coverage-ruby/#_AllFil...

We're not missing static typing as far as I know. We still are able to ship a lot of changes every month. I'm not sure if it is our structure (idiomatic Rails), test coverage (over 85%), something else, or maybe we should miss it but don't realize it.

One disadvantage is that static typing causes more lines of code than dynamic code. And code size is the best predictor of code quality http://blog.vivekhaldar.com/post/10669678292/size-is-the-bes...
Did you reply to the wrong comment? Your comment seems off topic relative to the parent.

Regardless, your workflow of 'git diff' on staging with 'add's functions the same as 'git diff HEAD~' on a commit with 'commit --amend's
What we need to solve this is a cell aggregation dependency function in the database.

Where we define a column and a query that will be used to define the values in the cells of the column.
The database would use its planer to figure out what the dependency's are and update the cell every time one of the dependencys are changed.

That dependency thing is very complex but very necessary. If you dont have it you might as well just make a normal view.
> Your comment was definitely a waste of my time (I didn't gain anything from reading it) so by your standards I should downvote you.

Yes.
Right, but barriers that a high percentage of users experience means it's a flaw. This factor cannot be ignored.

Taken to the extreme your statement is essentially: "Git works for me and me only therefore it is flawless."
That may be, but it's not clear to me from the article. What's the feature I'm missing that makes the SQL Server offering so much more compelling?
Are there any other fairly basic image recognition problems that people want? I'd be happy to provide as long as a dataset is easy to collect.
Anyway to download the image for use in a private cloud?
The decisions Firefox has made over the last years make less and less sense.
new S-Bahn S21, connecting Hauptbahnhof to Gesundbrunnen (northern "center" of the circle lines)
The obvious focus is deep learning, but those models need data, trained and deployed. There is a lot of work on those edges that require some AI knowledge. Also don't forget there are lots of AI techniques that are just as important now. So focus on an area that interests you, learn some of those AI methods and go! Every developer in the future will have to understand some of these methods at a basic level.
WOW, now I'll try to build a Bashmobile!

Thanks :)
I don't think it is that simple.

There is a tremendous amount of back scratching that goes on when setting executive pay.

The board hires pay consultants, the consultants are not going to rock the boat and suggest pay cuts, so they approve a nice increase over the current going rate. Rinse and repeat and you have out of control executive compensation.

Majority shareholders are often in the same position - very well paid, and well connected with other CxOs.

That leaves the rest of the shareholders along for the ride.
Most great ideas originate outside Silicon Valley, but the provincialism of the venture community there means that a mediocre idea in Palo Alto is much more likely to get funded than a really good idea anywhere else. Since only the funded survive, the resulting survivor's bias makes Silicon Valley look particularly innovative.
I can't figure out what you're referring to with this analogy.
Right, PDFium is the default. I've been using the PDF.js plugin for a while now and disabled the default via chrome://plugins.

Fortunately Chrome stopped supporting Foxit and Adobe PDF plugins with version 45 (released a year ago) when they depreciated NPAPI.

> As of Chrome 45, support for old, insecure NPAPI plugins is permanently removed. I believe Adobe Reader and Foxit Reader both integrate with web browsers through NPAPI plugins. If so, the old NPAPI-based Adobe Reader and Foxit Reader no longer works in Chrome, regardless of whichever version you have installed. http://www.chromium.org/developers/npapi-deprecation

It's interesting that they still expose their own C++ code to remote PDFs which apparently had some servere bugs: http://blog.talosintel.com/2016/06/pdfium.html
The Age of Container Wars
What is the current fascination with AI? It seems to be talked about everywhere right now. Yet "AI" in a core sense has been around since the 70's...
All ML networks are inherently biased towards its creators. My colleague recently described this issue to me as the "Old, white, male" problem. This is why most voice recognition services drastically fail when they are shown foreign accents.
There is also a very nice curses interface for interactive chunk selection. To turn it on set interface.chunkselector=curses under the ui section in your .hgrc.
They could've added support for HiDPI screens in pgAdmin and call it v4. Standing ovations would be a guarantee.

But no, they opted for a full rewrite with messy bowl of jQuery UI plugins and second-long animations.
Echoprint is wonderful for fingerprinting speed (C++), but the fingerprint size is actually smaller in Dejavu (binary(10) field in SQL for each fingerprint).

The other interesting differences to note are that Echoprint doesn't use a constellation fingerprinting approach along with offsets, and the fingerprinting is meant to be the same across all platforms / use cases so you can compare them.

As a direct result, you also can't get the offset in seconds that your query audio refers to like you can with Dejavu.

When I coded up this project, I wanted something that was more customizable - allowing you to decide the speed, number of fingerprints, size of the fingerprints etc to match your own false positive / memory / CPU requirements.

When you do, you sacrifice interoperability between all Dejavu index installations, but you gain that application specific performance. It of course depends on your use-case which library is better.
Only after you have given me a definition of intelligence which is not "what humans do"
No, it can't be done easily. ActiveX is basically COM+ with some extra interfaces, and it's a total disaster.

Mozilla had XPCOM many years ago, and they killed it.

So no, it can't be done. Certainly not safely.
I imagine you couldn't put his name on it which would be a huge deal if you wanted to sell it.
Marc Andreessen’s Sudden Silence on Twitter Stumps Silicon Valley
I'm still happy with them as a browser. But not sure now if they force PA on me. I've tired to use/install it (PA) before, but I couldn't stand the PA process hanging around in the background eating 20% of my cpu...especially on laptops.
This has been done, sort of. NSFW: http://deepdickdreams.tumblr.com/
Ask HN: Drive traffic from Twitter replies?
I'm wondering if it's worthwhile trying to get traffic by putting links in twitter replies, e.g if a person with large following tweets something interesting and someone @replies with a link to a relevant webpage or blog, does anyone follow the link?

I know it works in principle, just wondering if anyone can say from experience how useful this mechanism is for driving traffic to a website.
I suggest you drop that bank.
Storm chasers: the typhoon turbine that could power Japan for 50 years
Looks like Marc took some inspiration from the most recent South Park episodes.
Show HN: Ansible playbook for setting up Macbook Pro hardware on Ubuntu 16.04
Or they just turned safe search off and collected everything that doesn't also turn up on moderate search.
> How does static typing ensure you're mapping the correct JSON input fields to your custom types?

Ideally you push it all the way out. Rather than JSON you use Thrift or similar where the messages are strongly typed.

But if you do use JSON, how much benefit does unit testing your JSON mapping really give you? The mapping in code is just a list of field:field pairs, the test is just the same thing, is there really any value in repeating it twice? I'd sooner rely on careful code review than a test.
> PA process hanging around in the background eating 20% of my cpu

Sounds like a misconfiguration if anything.

For a typical user - PulseAudio "just works" and there's no more to it than that. It does make large improvements over just plain ALSA, and as far as I know, is included in all the major Linux distros... so many folks use it and never even know nor think about it.
Agreed. Advertisers are stupid these days. They don't realise that when they crap in their own backyard, nobody goes near them. If they want to misuse Flash (which they do, all the time) then we all stop using Flash. Most of us install ad blockers.
There is a silver lining however in that the destruction of the station precipitated the passage of the New York City landmarks law shortly after. Fun fact - Jackie Onasis was a high profile proponent of this legislation as well as raising awareness of architectural heritage in the city.
http://personalpages.manchester.ac.uk/staff/m.dodge/cybergeo... was a great resource back in the day.
PDF form support is one of the primary motivations for adopting PDFium in place of PDF.js.
True. But in my particular case I spent over 10 years eating like crap but exercising like crazy between being a part time fitness instructor and running that covered up a lot of sins. I cut down on exercising, got older, and it caught up to me. I acknowledge that it was all my fault.