skysight-inc/HackerNews huggingface dataset:
> This is a common meme, but I'd like to see some robust empirical evidence either way (the only studies I've seen so far are with e.g. a handful of undergraduates, implementing a toy problem, well-specified up-front, with no maintenance/feature-drift/etc.)

> In fact, my experience with "advanced type systems" (e.g. Agda, Idris and Coq), the types have never been a hindrance; it's their totality checking that can be painful (that's why Idris makes it easy to turn that off, either completely or for certain pieces of code).

A data point: if I'm reading this right, the seL4 formally verified kernel is
14,400 lines of code which required 2.2 person years to write and 20 person years to verify (proofs are done with Isabelle so it's not using types for proofs like e.g. Coq does but you can't escape a similar verification effort):

https://www.sigops.org/s/conferences/sosp/2009/papers/klein-...

"The abstract spec took about 4 person months
(pm) to develop. About 2 person years (py) went
into the Haskell prototype (over all project phases),
including design, documentation, coding, and testing.
The executable spec only required setting up the
translator; this took 3 pm.
The initial C translation was done in 3 weeks, in
total the C implementation took about 2 pm, for a
total cost of 2.2 py including the Haskell effort."

"The cost of the proof is higher, in total about 20 py.
This includes significant research and about 9 py
invested in formal language frameworks, proof tools,
proof automation, theorem prover extensions and
libraries. The total effort for the seL4-specific proof
was 11 py"

Why do you think function termination checking is a big factor? I find the majority of loops in apps are of the form "for everything in this collection" or a similar restriction that is simple to check.

Either way, if you start pushing complicated program properties into your types, you're very likely to have complicated proofs to solve by hand. What properties were you proving with types where you say they weren't getting in the way?
This particular love hotel had both a minibar and a (uncooled) toybar. Very mildly NSFW picture: http://www.patokallio.name/photo/travel/Korea/Suanbo/Motel_T...
Oh, you explaining it is a nice thing to do. I was just showing what was actually necessary to meet the intended goal since that's my field. I learned a lot of the problems from people like Myers who wrote the book on subversion back in 1980. Current approaches still aren't as thorough as what they were doing in the 1970's-1980's.

https://csrc.nist.gov/csrc/media/publications/conference-pap...

If it's about repos, I recommend David A. Wheeler's page on SCM security since following it eliminates most of the risks.

https://dwheeler.com/essays/scm-security.html
It’s probably a little of column A and a little of column B. A lot of good small decisions and probably 4-6 major ones, even in a 17year journey. If I had to guess. Who your business partners are. Major strategy shifts (cloud). Etc.
Not sure about everything, but last i looked IDA had a lot more support for different architectures and file formats compared to most of the open source stuff (not sure about other proprietary ones).
I got the same error as well
I took Sipser's class and read his book. I found Barak's textbook pretty good after that. You can read it out of order, and it has pretty good citations so you can always look confusing topics on your own.

"Computation Complexity: A Modern Approach" by Arora and Barak
> It also doesn't seem to allow eliding temporary assignments.

Yeah, there's no copy propagation for MLIL yet. I think they're saving that for HLIL, for some reason. It's exactly as obnoxious as you think it is, though. (For example- click on a variable name. Now other uses are highlighted. Ah, but when 80% of the other uses are just the right hand of assignments, which are then used... you get to trace through that fun chain by yourself!)

There's a community plugin to kind of try to fix this, by actually renaming the intermediate variables to match the RHS's name. This works, sometimes, but is written in Python, which means it's single-threaded and slow, and occasionally it will get stuck in a loop, and sometimes it decides that it wants to rename everything to "ecx_1" or something, in which case you become very grateful that undo exists.
Great, I can use this for that blogging app I've been meaning to write and sleep at night knowing I won't run out of connections.
Been looking for a way to get USPS physical mail notifications. Worst case scenario everybody will see that I get utility bills just like everyone else.
I'm so confused about why America is so reactionary when it comes to architecture, and to design in general.

I've been browsing Zillow and Redfin lately, trying to plan a few years into the future, and the architectural landscape is just horrific. My ideal is a modern, minimalist, fairly flat-roofed 1- or 2-story (think Rummer [1], Gropius, Eichler, the Eames case study house, Mies van der Rohe's Farnsworth house, etc.). I wouldn't mind oodles of raw concrete and exposed steel. Nothing ostentatious or expensive, mind you; just good design and modern materials.

I'm not that hopeful that anything close to this style appears in the areas I'm looking or in the price range. Instead, what you get are column-infested McMansions or hideously old-fashioned shingle monstrosities. The average home in the US seems to look like this [2]. The kitchen is always dark and brown. Random hideous reactionary baubles from Colonial Revival architecture abound. Beveled wood paneling is everywhere.

Now and then a rare (very rare) mid-century modern house come up that might be within my price range, but of course it doesn't have modern insulation, electrics, heating, moisture barriers, air flow, etc., so what you've got is a beautiful but cold, damp, technologically outdated and energy-inefficient box.

Ultimately, it seems good, modern design in the US is for rich people, which makes me sad.

[1] https://www.curbed.com/2018/8/27/17773540/midcentury-home-to...

[2] https://www.redfin.com/NY/Orchard-Park/30-Knoche-Way-14127/h...
Outside of the (valid) privacy concerns, I use this and considered it an awesome tool. Then I ran into the good old efficiency and effort of the USPS we all know and love... I was expecting a rather important document from the government, so when the image of it showed up in my Informed Delivery email, I knew to go to the mailbox that day, but the letter never arrived. Instructions on the USPS site tell you that even though you see an image of the mail piece, it might not arrive for up to +7 days later and they ask you to wait the full 7 days before declaring your mail missing - there is a feature where you click on a link to report a specific piece of mail as not delivered. So I wait exactly 7 days and what do you know, the link to report that letter is expired. They expire the damn link 7 days after the email is sent, which means if you follow directions you are sent into a literal black hole because apparently no one on the team tested for obvious logical conflicts. The letter never arrived and my report on this glaring flaw was never responded to.
Yeah, but I think the big issue is the lack of decompiler. If you're new to RE, it's literally night and day between that and "assembly with stack variables renamed and some helpful comments". (Even Binja's MLIL is a huge step up from the annotated assembly IDA provides.)
No, that's what I felt like deserved comment. Compare to recent events in the US. It isn't cool for media to disparage people who aren't given opportunity to speak for themselves.

As far as offended, no?
In what fields is this type of tooling used routinely?
I cannot reccomend against Kiel, iar, and atollic enough. They are garbage ide's (can only do string based auto complete, no dark theme, very poor window management), yet still cost a small fortune if you want to go above 32KB of flash usage or whatever other the free versions do. They also have their version of a linker script which is even worse than normal linker scripts, and if you are forced to use their compiler then often it doesn't even handle c++11. Or if it does have c++, the auto complete doesn't.

Go for gcc or clang with cmake (or even just make) and use qt creator or visual studio code or others. You will get cmake based auto complete, access to a proper IDE color scheme of your choice, get to use your own compiler (clang, gcc, etc), and it's much more flexible. And for debugging be able to use a much more capable ozone from segger, or even gdb enabled backend in qt creator or clion.

My work flow for example is cmake and gcc regarding tooling, qt creator or visual studio code which works with cmake to give me proper context aware auto complete, and clang-tidy as a linter running in the background. I am incredibly productive with this, and am able to make use of c++17's features to go for true zero cost abstractions, while shifting checks from runtime to the compiler via types and static asserts and whatnot.

Plus, this is far more portable. No longer having to worry about project files working across diffirent versions of keil (this bit me in the ass at my last company). It's just a simple text file.
That's a very important call-out. This is the kind of tear-your-hair-out stuff that's going to be very difficult to track down unless you get it exactly right. I echo that using the definitions makes the code infinitely more readable and writeable, and makes zero difference in terms of performance.
You are assuming that electricity is the only cost involved.

Based on the numbers in the article, the plant runs at 38-megawatts, consumes 100,000,000 gallons of sea-water a day, and produces 1 gallon of drinkable water per 2 gallons of sea-water.

Assuming a cost of 15.2 cents/kwh [0] (california seems to be one of the most expensive states), this comes out to an electricity bill of $451.70/acre-foot. A non-trivial portion of the total cost, but there is plenty of room for cost savings without reducing electricity usage.

Its also worth keeping in mind that Isreal exists, relies heavily on desalination plants, and is an agricultural exporter so we know the situation is solvable [1]

[0] https://www.npr.org/sections/money/2011/10/27/141766341/the-...

[1] Although will likely involve less wasteful agricutlure.
I'm curious if a similar procedure could be used to correct for colorblindness by making one eye into the "red eye" and the other into the "green eye". Filtering and enhancing color frequencies as appropriate.
Mahindra Pininfarina unveil the world's fastest car - and it's electric
It was a group of deaf people trying to get UCB to spend the money to better serve them.
I mean having a good UI is great but without the features to back it up, you can’t do anything serious. I tried cutter again a few months ago and went back to ida after an hour of frustration. When handed a binary dump with no executable format or symbols, cutter just chokes while IDA was able to quickly find 90% of functions in memory as well as data xrefs and strings and so on.

I’m sure everything performs well on ELFs built with -O0 -g but in most real world usage, Ida is queen.

Since everything is open source, if ghidra is as good as people say it is, I’m sure people will make better guis for it (and tui) in no time.
My personal reason for not pirating IDA Pro is because I don't want to contribute to the problem. It's one thing to argue about the effects of piracy on things like video games, where the unit price is much cheaper, and a large number of users are casual users who mostly are going to buy legitimate copies if it's convenient and not exorbitantly expensive.

Power user software, like Photoshop, IDA Pro, VMWare, etc. are a different story. They provide tremendous value to both companies and individuals and yet I have no doubt an enormous amount of their poweruser userbase simply have never paid for them. As a young adult or child with no practical way to get a license, this is pretty innocuous since frankly it's hard to argue any sale was lost. But there's plenty of cases where large companies and of course hobbyist users end up pirating the tools they use. I believe Windows XP shipped with some audio files that were produced with a pirated version of Sony Soundforge, for example. That's just silly, but.. it happened.

IDA Pro is an excellent piece of software. They provide a freeware version, which is a pretty nice thing to do. And while the licenses are expensive I have no doubt it is worth it to the companies that purchase it, many times over.

Sadly, I can't afford IDA (as I've discussed eerily recently in HN comments, actually) so I've been mostly avoiding it for now, but I do buy other software, including Windows licenses, Adobe Creative Suite, VMWare, etc. If they're useful enough for me to use, then as an adult with decent income, I pay for them.
like all of Obama's $2-$20 donations from gift cards originating in the Middle East. Nothing to see here zombies
Setting Up a Private OpenVPN Server
this happens all the time in other animals. i'd adopted two cats (boy and girl) who were littermates but had different fathers. their coat patterning and eye color were different even though their coloring and (small) size were similar.
i must be missing something. the story says they had to:

1. put epoxy resin on each side of the graphene membrane to prevent swelling when exposed to water (which is important because if the graphene swells, then it allows sodium chloride to pass).

2. "drill" 1 nanometer (or smaller) holes into this membrane

so, what role does the graphene really play here? i mean, as long as you can drill tiny holes into it -- could the filter be made out of other material?
Auto analysis when you have barely any information. Any tool can make nice output if you feed it nice input. Try a partial dump from an exotic device and then you’ll see IDA shine.
That's fraternal twins, though, not identical.
> How is collusion risky?

The first player to defeat from a cartel can take most of the market for itself, right from the other colluding players.
To be fair, there's definitely a difference between downloading a pirated version of software, and actually leaking copies of software for others to pirate. The DataRescue and now Hex-Rays folks seem particularly sensitive to leaked copies and I imagine leaked copies genuinely do affect their bottom line of sales given the kinds of markets they're in.
Oh, and I forgot to mention- despite being multi-threaded, it's slooow on massive (50MB+) binaries. Bother your co-workers! Play Pokemon GO outside! Make lunch! Take a nap! Use the foosball table in the 'game room' that's there because we want to seem trendy! When you're done, perhaps the initial analysis will have finished.

If you're on the dev branch of binja (which, at least until recently, was miles ahead of stable), you get to do this again in a few days when binja updates and throws out all its old cached information.

Also, saving and loading massive databases can easily be a 5-minutes-or-more process. Again- this does provide you with ample time to explore the area around your office building, but still.

(Mind, this isn't a problem if you mostly see small binaries- for malware it's probably entirely fine.)
off topic: Is there some service by USPS where I can have a P.O. Box, but have my mail forwarded to any address?

I find myself having to move a lot, and trying to keep track of all the addresses I need to update is challenging for myself. I'd love to have a service where I can send my mail and only make an address change on that service when I need to update my mailing address.
> column-infested McMansions

Thing I realized is these things are basically lowest common denominator residential construction meets Mr Potato Head.
I agree that the decompiler is amazingly useful... but it's pretty telling that there's really no alternatives that come close. I sympathize with hobbyists that pirate IDA Pro, but I personally wish we could do better than that.
Uber not criminally liable in fatal 2018 Arizona self-driving crash: prosecutors
I agree that corporations are not just the sum of its parts.
It is entirely valid to model a corporation as an artificial intelligence that happens to use human brains as hardware.
Taking a job at a corporation can then be seen either as joining it, or as interacting with it.

If one is joining a corporation, the individual's choices are part of the AI that drives the corporation. In this case, it is essential for individuals to act morally, in order to predispose the corporation to act morally.

If one is interacting with a corporation, there is no expectation that it will behave morally. Therefore, to increase the likelihood that it will perform moral actions, it should be painful for the corporation to perform immoral actions. That punishment can be inflicted by bringing negative PR, by negotiating contracts that avoid immoral actions, or by quitting and thereby forcing the company to pay higher wages to attract the same talent.
I wondered if you could actually do something not quite like that, which is create a quartz version of yourself and then embed that in a chunk of concrete or something and bury it so that 10,000 years from now someone could "unpack" it.
For those wondering what Ghidra is: it's a software reverse engineering (SRE) suite of tools developed by NSA's Research Directorate in support of the Cybersecurity mission.

Ghidra website: https://www.ghidra-sre.org/
Delete Never: The Digital Hoarders Who Collect Everything
Money laundering is fraud. Most of the transactions involved companies created and owned by the Troika Dialog. This money laundering directly enabled a number of very harmful and illegal activities.

While I can understand valuing and protecting financial privacy, I fail to see how you can see Troika Dialog as blameless here.

In general, financial privacy must be balanced against financial transparency and enforcement. Tax evasion, embezzlement, bribery and other financial crimes come with significant costs to society.
It really is a job for a GUI, but even IDA lets you type commands. You can use Python, or a built-in language that is in the C family, or anything custom that you have attached to the plug-in interface. I would be surprised if one of these tools is lacking such a capability.
Definitely- it's all the years of tweaking and the massive numbers of heuristics to handle, i don't know, code emitted by Microsoft Visual FORTRAN from 1972- that's IDA's moat. Screw the decompiler. If GHIDRA can match that, it's a huge step forwards.
FDA approves esketamine, the first major depression treatment in decades
Apparently he no longer owns scrape.it. He previously replied to my comment to say he sold it and to threaten legal action. He deleted the comment and sent me the following email:

> If this comment is not removed immediately I am going to have to involve legal. Scrape.it is no longer under my direct control, it has been acquired as of Feb 2019.

> Cheers,

> John Kim

> Scrape.it Founder

So I guess he was the founder but is no longer involved.
Animals that commonly produce liters of multiple offspring typically do so by releasing multiple eggs simultaneously in each period of fertility. This also happens in humans in the case of fraternal twins (two eggs each fertilized by a different sperm).

That’s very different from one egg being fertilized by a single sperm and then splitting (which produces identical twins) or being fertilized by two sperm (which is what happened in this case).
Wow So crazy a Git user manager – Gitum
An overhyped tweet. You have to enable debug mode on it. It's not something that runs by default.
>but the best way to hide a backdoor is to make it look like a mistake

It is, but usually the best way to do is to make it look like a mistake that's very subtle and difficult to notice without careful testing and analysis, kind of like Apple's infamous SSL "goto fail". That's a classic example of a vulnerability that really could be either an honest mistake or a very insidious backdoor.

This is more like leaving the house's sliding glass door to the backyard wide open for everyone to see.
App Web de Vue and Element-UI and Lumen
If you suspect a race condition between two operations, one way of testing it is to add a sleep command to one side or the other. For example:

(sleep 1; echo red; echo green 1>&2) | echo blue

vs

(echo red; echo green 1>&2) | (sleep 1; echo blue)
I'm not trying to deny your experiences, but sometimes you just have to accept the way the world is: there's no big company behind Linux support on laptops, so you have to go where the most users are. If you want to use OSX, you buy macbooks. If you want to use Linux, you buy thinkpads. It's sad, I wish I had more hardware choice, but I accept that I don't. Windows users are the only ones that do.

For the record, I'm current using Ubuntu on an X1 carbon 4th gen and it has worked literally flawlessly since day 1, no issues with wifi, bluetooth, or sleep, and it has great battery life. My X220 before that was 98% perfect.

Thank you for reporting bugs, though!
At some subway stations in Shanghai (notably People's Square and Xujiahui) there's more space devoted to shops than to the subway proper. (Those are outside the area you have to pay to enter. Inside, there are also shops, but not very many.)
Investing Approach
Graphene is incredibly strong.
I don't really see the relevance, at least wrt journalism with high stakes like the national security beat:

https://theintercept.com/2014/12/19/senior-cia-officer-cente...

How could that possibly have been published using the "pull" method?

But most importantly, it seems like a red herring. Regardless of push or pull, the significant question for national security reporting is this: does the news gathering organization have enough money and prestige for a legal and PR team large enough to publish against the objections and pressures coming from the government?

If the answer is yes, you've got yourself a functioning national security division. If the answer is no, you're that "knucklehead" just asking to be made an example of, and you (wisely) don't publish the name[1].

I'm sure a lot of other types of news require similarly strong teams to write meaningful news stories against the wishes of other large and powerful organizations.

Edit: "knucklehead" quoting the ACLU lawyer's advice to that independent journalist. I personally admire his work on that story, and he's mentioned in the Intercept piece. :)

[1] https://www.youtube.com/watch?v=oeEB6F8fmbY
I remember reading about this 5 years ago.

I wonder how far progress has gotten today?
Tabs will likely be grouped by task as they are opened either around the same time or often as as a new tab from one of those windows. Another key advantage of open tabs is they save the state of the page you were on when compared to bookmarks.

There's obviously benefits to a more robust way to manage your work state. I'd view it in a similar vein as the advantages of a tidy desk: Some people lack the discipline to keep that state and can somewhat compensate for some of the disadvantages i.e. by application of spatial memory and the advantage of having everything to hand.

If people are going to do things the wrong way regardless providing them tools to improve their situation can still make sense.
Disclaimer: I am an idiot on this subject

I recently found out that you can’t easily spawn a shell and then send commands to it. It’s doable with tmux commands, but you’d think it would be easier. I just wanted to write something that locates npm/virtualenv stuff in bash, nothing fancy.