skysight-inc/HackerNews huggingface dataset:
A few points:

1) failing loudly is better than failing silently. A memory corruption issue (or a bad refcount, etc.) is not a benign issue that only becomes relevant under carefully crafted exploit conditions. You need the carefully crafted exploit to get the system back into an attacker controlled state (I.e. code execution); by itself (with non-malicious inputs, usually something random or slightly atypical — enough to not have been noticed yet, but typical enough that some program does it) the system is likely to either panic immediately (same result as with pax) or to corrupt some memory, in which case you will have a lot of strange behaviour to track down later (users will probably blame them on hardware or on their user space, so you might never see them. for example a recent OSDI paper showed that ext3/4 had several real world data corruption bugs. If these aren’t as frequent as the recent bcache issues, no one notices).

2) When I was doing research projects (into memory defenses on the kernel) about 3 years ago, there was no (commonly used, that I saw) automated testing infrastructure in the kernel. This makes catching regressions, especially in drivers for rare hardware, hard to catch. While tests aren’t a panacea, i think Linux overestimates what fraction of problems Code reviews will catch.

3) the “don’t break user space” strategy is already failing. Every mainstream distribution and embedded vendor stays on an old kernel branch. Big deployments do staged rollouts and extensive burn in tests. This isn’t just because the kernel, but because of extensive abreaking changes everywhere (compilers, standard libraries, etc. all need to change sometimes).the last time this happened, IIRC it was some audio bug in a strange configuration. In my experience, running a non standard Linux audio confit causes countless breakages, so an additional one in the kernel that might save my personal data from being exfiltrated is worth it. Most users have average (and therefore well tested) setups, which means thy won’t see breakages as often.

Perfect software doesn’t exist, and even MSFT backed off maintaining religious backwards compatibility (note that Microsoft’s approach was not to flame at developers and hinder new development, but through extensively building compatibility shims. Often, these came with trade offs strongly in favours or security, e.g. UAC).

Breaking user space is ok; users already expect breakage, and the cost of the additional breakages is low (to users and to society as a whole) compared to the cost of security breaches [citation needed, but Linux kernel security is relied on in a lot of places].
The arguments against net neutrality often focus on crappy connections; on 3G networks and early DSL it was common to have rate limits, which made people be very careful with how much internet they used, and/or additional fees above a certain bandwidth usage - similar to utilities like electricity and water (although IDK why there was never really much pay-per-megabyte internet, usually it's a flat fee).

The arguments against net neutrality are related to that; instead of limiting how much people use to keep the pipes open and fast enough so to speak, it's giving certain services preferential treatment, so that in the case of limited bandwidth those aren't disrupted.

Of course, it's a silly thing; most landlines, especially in the cities, will have fiber connections at least up until a local distributor box, and in some cases to the door. This has many gigabits of capacity, which should be enough for everyone.

The thing is that apparently, investments in bandwidth aren't being done enough. Google gave it a good try with their fiber service, but had to give up - probably underestimating how expensive it is, or they were blocked by the existing ISPs that didn't tolerate competition.

TL;DR, I think the problem isn't available bandwidth or whatever, it's competition, or the lack thereof, and investments, or the lack thereof.
A.k.a. 99.9999% of the time.
Of course it's "anecdata" because I've never personally conducted a test of all security consultants for their programming skills.

But the people you tell about (developers who specialized in security) maybe exist in large shops (Google, MS, FB), but many, many security consultants will work for specialized firms that offer security services, but not software development, and vice versa. Take a look at most Defcon/BlackHat talks where a vuln is explained/uncovered/exploited: most such researchers don't pertain to a software development firm, but to independent security firms.

Why should my assessment not be useful? I proposed a very clear solution to what is the problem.

Source: I worked for almost ~10 years in a firm who had both a software development and a security services branch, met tens of security consultants and worked in remediation activities for software issues where the security consultants weren't able to do it.

EDIT:
about the kernel code, I agree with you that such code is a step in the right direction, but I agree with Linus that the "warn" should come before the "kill".
A thought experiment that comes up in Kernel design classes is what should happen if the OS was running the flight-control software for an Airplane you are on? If there was a bug in the kernel, perhaps a double free or a memory leak, what should happen?

A panic would result in the airplane falling to certain doom. But if it were to keep running, it may be a security vulnerability. Being absolutist in either direction of the discussion will lead to absurd scenarios where you would make the wrong decision.
Is Uber really a more egregious offender than Exxon-Mobil? I am not at all defending large "tech" companies but to pretend that they are the first (or the worst) when it comes to dodging taxed is rather silly. Exploiting every last tax loophole possible is something common to all sufficiently wealthy individuals/corporations—even the queen herself is in on it.
Yes. Poorly written drivers are a major piece of attack surface for Linux devices.
The upcoming .3 release will support a custom package archive. A lot of the bugginess in Spacemacs is caused by frequently pulling 100+ bleeding-edge MELPA packages.
Linux is used in so many critical systems.

What happens when a security bug stops the ventilating machine of a person lying in hospital bed, or halts the screen of a surgeon.

Not to mention voting machines, ISP's, telecoms.

For me having all those stopped, when properly exploited, looks more like a very scary DoS attack vector.

Imagine a security f*ck up, like Heartbleed, but this time with an option to halt kernels / systems.
Buy on Coinbase or Kraken, buy a Ledger cold wallet and move them there instead of keeping on the exchange
It's not so black and white. Medtronic uses Linux. Do you want to be the guy who's medical equipment spontaneously reboots because of a bug that wouldn't have otherwise affected anything?
This is the most insightful Linus writeup yet. His others are good too, but this just hits the spot. Great!

Funny note, this post could have been a textbook sort of material. At the end he even says please. The only thing that breaks it is the reference to touching oneself :)
Security is meaningless if your system doesn't work. Makes sense for me. Or your car is forbidden from starting after an upgrade because you might run over someone tonight. It's a trade-off.
> Why would you not want this?

I was writing paper, on a PC, that was like "pip pip pip pip pip"
and then... like half of my paper was gone.. and I was like...

It devoured my paper.

It was really good paper. And then I had to write it again and
had to do it fast so it wasn’t as good. It’s kind of... a bummer.

https://www.youtube.com/watch?v=VMt2MK67-Qw
Someone explained to me a while ago, in New York State, it was illegal to discriminate on race, color, religion, sex, etc. for renting out apartments in 3+ unit dwellings.

As an owner of a single home, renting out the upstairs apartment, it was supposedly perfectly OK to discriminate based on those things.

I never dug into this, but if it is true, the question is: "Should Facebook ad tools facilitate such discrimination, even if it is not forbidden by law?".
This would be something like the Hurd for example (or Mach based systems), as far as I understand.

Over there drivers and whole subsystems are running as separate processes and just pass messages. Is that what you're interested in?
Show HN: Web slide hosting
None of the tech companies you mention are innocent at all.

I didn't say they were, and I'm not making any such claim. But that's irrelevant to the point I was getting at, which is simply that this currently popular narrative - that there's some widespread popular angst directed at AmaGoogFaceGramSoftHoo - strikes me as incorrect and possibly fabricated.
Did you read the webpage? BitPay is a payment processor. They mention the increase in total BTC transactions but it focuses on their growth as a payment processor
Sadly, fault-tolerant clusters where you can tolerate the loss of a single machine aren't the norm.

There are many (MANY) server applications or industrial use cases that do not handle random kernel panics very well.

I still prefer "crashing" over "silently ignoring critical errors", but you cannot generalize it like that.
Its a space where millions are raised on nothing more than a whitepaper, probably a bit idealistic to expect rational actors.

Bitfinex has been undergoing third party audit from Friedman for months now. No one cares though and still throw accusations around like confetti.

Anyone who knows this fact and doesnt trust Friedman as a multinational auditor/accountant should say as such, rather than repeating blatant falsehoods.

It quite easy to see what others have to gain from the negative coverage.

Exchanges ddos each other all the time, its a shady industry, 15mins downtime for poloniex can double the weekly income of small exchanges.

I'd hope hn readers see between the lines a bit more rather then jump on bandwagons.

https://www.bitfinex.com/posts/202

http://www.friedmanllp.com
Fixing all memory corruption bugs is infeasible without fundamentally changing the way Linux is developed. There is so much code (and it’s being added to, changed, etc.) written by humans that make mistakes.

There will always be some bugs that are in between being discovered (by someone, maybe malicious, maybe not), and being fixed. How else do you prevent against vulnerabilities in that stage?
I'm glad someone's bringing up fintech. I'm not at all convinced that HFT, etc. provide any social benefit whatsorver. At least cryptocurrencies have interesting applications with regard to decentralization and autonomy.
I can't think of single useful piece of software nowdays that is exposed to public and can't run in active-active load balanced or clustered scenario. If your kernel/system/userland-app misbehaves it simply needs to be shut down, reported and examined.
It might have been some random memory block the last time your app made an buffer overflow, but it could as well be the stack pointer next time...
I've also wanted such an extension so after reading this comment I was finally spurred into action.

It works on a few sites I know are popular plus any that use the standard div with "itemtype" set to "http[s]://schema.org/Recipe", which seems to handle about 85% of the long-winded blogs out there. It extracts the recipe div and displays it nicely at the top of the page, dimming the site behind it. It has a button at the bottom of the recipe to dismiss the popup. Most sites include a handy print link or button at the top as well so you can quickly click through to that formatting as well (i.e. if you actually print recipes or use the Paprika recipe manager bookmarklet).

You can install the CRX directly: https://raw.githubusercontent.com/sean-public/RecipeFilter/m...

I will work on it some more to have proper controls, icon, work on more sites, etc then get it into the Chrome Web Store for easy installation.

Thanks for the final push!
I disagree. I don’t want to play the smartass, but I’ve been into Bitcoin since late 2012 and I just started to sell very recently, when a small investment (low 4 figures) and some lucky events like particiating in early ICOs (for ex. Ethereum in August 2014)became a life changing amount of money (high 7 figures).

This is not entirely true because I sold a little (very little) in November 2013 just to be able to “touch” those paper profits. I needed to see they were real and could impact my life. Anyhow 95% of my stash remained untouched until very recently.

The rationale for me was crystal clear: this technology has the potential to change the world forever (yes, I’m a true believer). This shit can be the biggest revolution since the internet. Sure, it can go to 0, but the downside is clear: I could just lose everything that i invested, which definitely was money I could comfortably afford to lose. On the contrary the potential upside is enormous, 1 dollar could easy become 10k.

Therefore I simply decided I was not going to sell unless I could comfortably retire on the profits. And that I would leave a little btc for my kids, no matter what.

I really can’t understand how anyone could buy Bitcoin early on with a different mindset.
Does make me wonder, will we look back at this time of unregulated tech companies and social media in 50 years the way we look back at unregulated sale and advertisement of tobacco today?
But do you want your box to send silently corrupted data for the next two years? Or would you rather reboot every night, and maybe escalate to your red hat support contract, where someone will then fix the underlying bug (for which you now have crashdumps),
6 Ways to Use Augmented Reality at Your Events – NVOLV
https://www.atlasobscura.com/articles/sunspots-japanese-amat...
But as he explains, these are latent bugs. They may or may not be targetted for exploitation yet. Meanwhile hard crashing over them can lead to poor user experience, while throwing up warnings and leading to an actual fix would be better from user PoV, unless of course userspace actually depended on the buggy condition, but that's another discussion.
They're choosing backwards compatibility over bad security (kill everything instead of reporting and fixing bugs). Applying duct tape everywhere instead of fixing things can hardly be desired.

And as a side note, backwards compatibility is what made windows succeed.
Well, you may call it surveillance cams but it may not be a bad thing. But as a Chinese, I never feel stressful under these cams in China, but feel unsafe all the time walking down the street in SF in the night after moving to US.

Purpose matters.
A hermit is anyone who intentionally separates themselves from society. Mauro Morandi is also a hermit if you ask me.
Linus' response is that calling it an infeasible problem is a cop-out. The right way to go about it is to fix them all, incrementally if need be, and not break userland in the process.
Remote laser cutting over network
Game over for humans
Are you suggesting that the NYT is faking its own editorial view point?

Of course not. How would that even make sense?

Note that w/r/t the parent of my post above, and my subsequent response, we've clearly moved beyond talking solely about the currently linked article, and are talking about something broader.
"Regulation is bad for the open market" - that's the root of the problem here. If it weren't for various "licences", "concessions", "permits" to become mobile operator or be allowed to install your cables then we will not need a discussion about net neutrality.

Definitely the bar to become ISP is too high, lower it and the problem will be gone. I don't belive that people don't want to become ISP just like that - something is wrong here.

On the other hand I have to say that sane regulations make sense, for instance mobile operators in Poland who own hardware infrastructure are obliged by law to sell bandwith to virtual operators when requested. That indeed lowered prices and provided better serivces including mobile internet. However, to have a full picture, I need to say that at the down of mobile telephony in Poland, initial investment and infrastructure was build by companies owned or controlled by the state, so, to some extent, infrastructure was payed from public money and later sold to 100% private entities.
Not sure what "realistic" means? Has he been there?

People take away this artistic images and believe the world is like this, but it isn't. Same with WW2 movies, people believe war is like in these movies, it isn't. But in one case it's hollywood, in the other case it's a news outlet.
Show HN: Professional broadcasting engine written in c++, opencl, opengl and qt
Elasticsearch: Working with Indices
On iphone sc chrome browser, what they've apparently done is completely reimplemented scrolling;

the website has its own scrollbar, on top of which chrome renders its own, and the site seems to be scrolling in place of the browser, as the "smooth-scrolling" behavior is entirely gone, as well as other little things like scrolling past the end of the page and being bumped back up
The Most Convenient Option to Start Own Local Service Marketplace
Turn your computer into a USB device server
If you reason for not getting sexually involved with a subordinate is that it is wrong to abuse a position of power, how is there not an ambiguity there - or the rule goes out the window - if the subordinate is initiating?

To pretend that the "correct answer" is always so straightforward is to assume that people never make it messy by addressing your assumptions and actively trying to change your mind about it.
Thanks for sharing this one. Also interesting.
Coinbase reaches 13M users
Real-time facial motion capture in Unity 3D using iPhone X
Web browsers are, for practical purposes, exposed to the public. Linux doesn't run only on servers.
I feel like this has slipped many by. People consider Big Oil or Big Pharma the evil huge companies whereas tech is still the rebellious underdog changing the world.
I still prefer Eclipse over IntelliJ IDEA

Same. I tried IntelliJ earlier this year, and thought it was pretty crap. Certainly nothing about it wowed me to the point that I thought "Gee, I need to ditch Eclipse and use this instead".
r/VaporwaveAesthetics

r/Outrun

r/catastrophicfailures

r/holdmybeer

r/holdmyredbull

r/contagiouslaughter

r/nevertellmetheodds
I honestly find "tech" to be way too broad of a label and only really see major problems with social media and fintech. Juciero-type companies are stupid, sure, but they're not hurting anyone. Instagram and Twitter, on the other hand, are likely strong net negatives for society.

Edit: Microtransaction-based games that are essentially gambling simulators are highly problematic as well.
Apple Bought Augmented Reality Headset Company Vrvana
Using F-Droid and Yalp and avoiding the Google Play Store is only an option if your needs are very limited. As far as I know, there are no widely-adopted mobile payment apps anywhere else, certainly the de facto standard mobile payment app in my country is only available on the official app stores.

The same goes for banking apps and all official store membership and coupon apps, just to mention a few categories of apps you will have to do without.
You seem to be one of those "security people" Linus refers to. ;)

Harm is relative. You security people think that every single security issue is so important that it doesn't matter what harm mitigating that may cause, it can be done. Well, that is not what Linus thinks.

Kernel may terminate a process because it did something of suspect but doing that may actually cause way _more_ harm.

The philosophy here is that security bugs are just bugs.
Truffle + Graal looks awesome. I looked at some old ZipPy slides (JIT compiler for Python) here: http://socalpls.github.io/archive/2013nov/slides/zippy.pdf

They have an example where this code is compiled:

def sumitup(n):
total = 0
for i in range(n):
total = total + i
return total

It was optimized quite well, but still had loops. I know this is a lot to ask, but I would have expected it to be possible to specialize it to a loopless variant:

def sumitup(n):
if n < 0:
return 0
else:
return n*(n-1) // 2

Clang 4+ actually finds this optimization, but gcc and icc doesn't seem to: https://godbolt.org/g/v4zhrm

That is, the assembly generated by clang seems to be equivalent to

if n <= 0:
return 0
else:
return ((n-1)*(n-2) >> 1) + (n-1)

which might even run faster on the CPU, due to the speficic code emitted.
This has nothing to do with either SV or tech in general, it's like blaming car makers for Al Capone because he used them to get away from the police.

It's more like blaming Ford for the Pinto ("unsafe at any speed"). Deliberate design choices are what made fake news effective.

Think of Fake News as spam email: Gmail (and others) mostly solved spam email because they decided to. Apple made a deliberate decision to manually review apps in the AppStore. Twitter made the deliberate decision not to ban spam bots in its ToS(!). Facebook made a deliberate decision to reward engagement on links.
Most apps are worth 0.99, even if they cost significantly more to develop. When one considers the ads, tracking, changing features from under the customer, that's their value.

The stuff that's really good costs money also on iOS. The Abby OCR is 64 EUR, OmniFocus is about 44 EUR, Korg Gadget cost 45 EUR (now 20, maybe a special offer).

What keyboard to use is a freedom, but not really an important one. It's a convenience.

I recently bought an iPad for my parents and that allows them to have a device which is very unlikely to get infected by spyware or malware and I can count on their private information remaining private. That gives them the freedom to use it as they like and see fot, without having to worry. And without me having to keep up with whatever tracking fuckery Google thought up.
One of the point of Linus is that most of the crashes will not be because of an active attack but because of a possibly latent bug that sometimes appear and might very well be non exploitable. So probably people running server would like to have everything working instead of having random crashes on processes or drivers that are not the core of your service but can affect it. And given the size and complexity of the kernel it would not be strange to have these crashes appear only on certain setups and not necessarily on the ones of the people that are testing it first.
Telecommunications companies are utilities whose use of this data is highly regulated. Google not only has locaton, it has contacts, browsing history, calendar, gmail, etc, and it has the legal right to combine this information together.
Fake Facebook message warns users not to accept Jayden K Smith hacker
You could have a git hook (even remote) that would check for pre-configured patterns and reject the push if it contains them.

Quick google yielded this https://github.com/awslabs/git-secrets
Add visual snow and you don't even experience darkness.

https://en.wikipedia.org/wiki/Visual_snow
Consider that not much more than a decade before the SR-71 project started the state of the art in plane design was canvas over a wooden frame with a V12 engine that went at 300mph.

How much technology did they have to invent from first principles to build a plane which flew at Mach 3 at the edge of space? Using slide rules and chalk boards?
AFAICS, Linus also wants it, but he wants a panic to be preceded by a rather lengthy span with just a warning, allowing the concerned dev to actually fix the error. Essentially he's saying: "take it slow, and don't break user experience."